Grafana: >> Grafana >> 12.4.2 Security Vulnerabilities
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
CVSS Score
5.9
EPSS Score
0.003
Published
2026-05-13
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-05-13
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-05-13
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-05-13
Page 2