Affected by GO-2024-2513 and 42 other vulnerabilities

GO-2024-2513: Grafana information disclosure in github.com/grafana/grafana

GO-2024-2515: Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana

GO-2024-2516: Grafana XSS via a column style in github.com/grafana/grafana

GO-2024-2517: Grafana XSS in header column rename in github.com/grafana/grafana

GO-2024-2519: Grafana world readable configuration files in github.com/grafana/grafana

GO-2024-2520: Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana

GO-2024-2523: Grafana stored XSS in github.com/grafana/grafana

GO-2024-2629: Grafana's users with permissions to create a data source can CRUD all data sources in github.com/grafana/grafana

GO-2024-2661: Arbitrary file read in github.com/grafana/grafana

GO-2024-2697: Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana

GO-2024-2843: Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana

GO-2024-2844: Grafana User enumeration via forget password in github.com/grafana/grafana

GO-2024-2847: Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana

GO-2024-2848: Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana

GO-2024-2851: Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana

GO-2024-2852: Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana

GO-2024-2854: Grafana folders admin only permission privilege escalation in github.com/grafana/grafana

GO-2024-2855: Grafana Plugin signature bypass in github.com/grafana/grafana

GO-2024-2856: Grafana Race condition allowing privilege escalation in github.com/grafana/grafana

GO-2024-2857: Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana

GO-2024-2858: Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana

GO-2024-2867: Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana

GO-2024-3079: Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana

GO-2024-3215: Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana

GO-2024-3240: Grafana org admin can delete pending invites in different org in github.com/grafana/grafana

GO-2025-3438: Grafana Alerting VictorOps integration could be exposed to users with Viewer permission in github.com/grafana/grafana

GO-2025-3704: Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana

GO-2025-3740: Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana

GO-2025-3742: Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana

GO-2025-3766: Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana

GO-2025-3814: Grafana's insecure DingDing Alert integration exposes sensitive information in github.com/grafana/grafana

GO-2025-3817: Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana

GO-2025-4153: Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana

GO-2026-5095: Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana

GO-2026-5219: Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana

GO-2026-5332: Grafana has a Cross-site Scripting issue in github.com/grafana/grafana

GO-2026-5409: Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana

GO-2026-5708: Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana

pkg/

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/grafana/grafana

Links

Open Source Insights

Directories ¶

Path	Synopsis
aggregator module
api
avatar
dtos
live
pluginproxy
routing
static
apimachinery module
apis
folder module
secret module
apiserver module
build module
wire module
bus
cmd
grafana-cli command
grafana-cli/commands
grafana-cli/commands/commandstest
grafana-cli/logger
grafana-cli/models
grafana-cli/services
grafana-cli/utils
grafana-server command
codegen module
components
apikeygen
dashdiffs
dynmap
imguploader
null
securejsondata
simplejson
events
extensions
infra
metrics
metrics/graphitebridge Package graphite provides a bridge to push Prometheus metrics to a Graphite server.	Package graphite provides a bridge to push Prometheus metrics to a Graphite server.
remotecache
serverlock
tracing
usagestats
features module
log
login
social
middleware
models
plugins
datasource/wrapper
codegen module
sdk module
promlib module
registry
semconv module
services
alerting
alerting/conditions
alerting/notifiers
annotations
auth
cache
cleanup
dashboards
datasources
guardian
hooks
notifications
provisioning
provisioning/dashboards
provisioning/datasources
provisioning/notifiers
quota
rendering
search
session
sqlstore
sqlstore/migrations
sqlstore/migrator
sqlstore/sqlutil
teamguardian
setting
storage
unified/apistore module
unified/resource module
unified/resource/kv module
unified/resourcepb module
tsdb
azuremonitor
cloudwatch
elasticsearch
elasticsearch/client
graphite
influxdb
mssql
mysql
opentsdb
postgres
prometheus
stackdriver
util
sqlite module
xorm module

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL