Grafana Labs protects our users, their data, and the integrity of our platform through proactive security measures, transparent communication, and continuous improvement.
Stay informed about security vulnerabilities, best practices, and updates affecting Grafana products.
Access comprehensive security resources and documentation to help secure your Grafana deployment.
Verify our commitment through certifications, compliance reports, and transparent security practices.
Track the latest CVE records, security notices, and advisories to protect your environment.
Grafana Labs maintains high standards of data privacy and security by implementing:
Life Cycle Management of Users (LCM), including Security Training
Best practices for internal Data Loss Protection (DLP)
Multi-factor authentication (MFA/2FA)
Regular infrastructure vulnerability assessments
Independent third-party penetration testing and independent audits
Grafana Labs development includes continuous integration, detailed change management policies, static code analysis and vulnerability analysis.
We implement industry-standard security technologies and procedures to protect our customers' data. View our Trust Portal to access our security reports, certifications and attestations.
| Published | CVE | Severity (CVSS) | Advisory Title |
|---|---|---|---|
| 2026-10-13 | CVE-2026-93294 | Medium (6.3) | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs |
| 2026-10-13 | CVE-2026-15577 | Medium (6.5) | Git Sync connection configuration can be modified with read-only access |
| 2026-10-13 | CVE-2026-95502 | Medium (5.3) | Git Sync memory exhaustion via a malicious Git server |
| 2026-10-13 | CVE-2026-33374 | Medium (6.5) | Unbounded memory allocation in the Prometheus rule conversion API |
| 2026-10-05 | CVE-2026-89039 | Medium (6.5) | Arbitrary file read via the convert_playwright_script prompt in mcp-k6 |
Responsibly disclosed by Eric Sowah Badger (niihack)
Responsibly disclosed by Yeonoh Park @ CIS Lab, SeoulTech
Responsibly disclosed by mon3m
Responsibly disclosed by Dohyun Choi, CIS Lab, SeoulTech
Responsibly disclosed by Harish Kolla
We completed our internal investigation of the recent TanStack supply chain ransom incident and confirmed our initial findings: The incident was strictly limited to the Grafana Labs GitHub environment. There was no unauthorized access to customer production systems, and the Grafana Cloud platform was not affected. Read more about our incident response and remediation.
Grafana Labs confirmed a targeted attack by a cybercrime group that gained unauthorized access to our GitHub repositories and downloaded our codebase. Here is the latest update about our investigations.
Today we are releasing Grafana 12.4.2 along with security patches for Grafana 12.3, 12.2, 12.1, and 11.6, which include critical and high severity security fixes. We recommend that you install the newly released versions as soon as possible.
