On 15 September 2026 Grafana published CVE-2026-15815, a plugin archive extraction flaw that can end in remote code execution as the Grafana server process. On 13 October it followed with four more advisories and a batch of patch releases: 12.4.13, 13.0.11, 13.1.8 and 13.2.4. Earlier in September, on the 2nd, three others landed for SAML, auth proxy and SQL data sources.
Most of these need a logged in user or a specific setting. The plugin one is different, because the way you install plugins decides whether you are exposed.
What's affected
| CVE | Date | Needs | Impact | NVD score |
|---|---|---|---|---|
| CVE-2026-15815 | 15 Sep | A plugin archive installed on the server | Symlink escape writes an executable outside the plugin directory, RCE | 8.8 |
| CVE-2026-14199 | 2 Sep | Auth Proxy with sync_ttl above zero | Cache key collision, session as a higher privileged user up to Administrator | 7.1 |
| CVE-2026-12704 | 2 Sep | Enterprise, SAML allow_idp_initiated on | InResponseTo skipped, replay of a signed assertion | 6.8 |
| CVE-2026-19475 | 2 Sep | Query access to MSSQL, PostgreSQL or MySQL data source | timeGroup macro in WHERE bypasses an earlier fix, memory exhaustion | 6.5 |
| CVE-2026-93294 | 13 Oct | Query access to an Azure Monitor data source | Resource proxy reaches other Azure Resource Manager APIs | 6.3 |
| CVE-2026-15577 | 13 Oct | Read only Git Sync access, on 12.4 the provisioning toggle | Modify a connection through its status subresource | 6.5 |
| CVE-2026-33374 | 13 Oct | Any authenticated user | Prometheus rule conversion API has no body size limit, OOM | 6.5 |
| CVE-2026-9703 | NVD 15 Oct | Viewer role and a Loki data source | Create, edit and delete Loki alert rules via the data source proxy | 7.1 |
Fixed versions from Grafana's advisory pages: CVE-2026-15815 is fixed in 12.4.11, 13.0.9, 13.1.6 and 13.2.2 or later. The 13 October batch is fixed in 12.4.13, 13.0.11, 13.1.8 and 13.2.4 or later. So those four releases cover everything in the table. CVE-2026-9703 lists 12.3.9, 12.4.6, 13.0.4 and later as fixed, and the October releases are above all of those.
A note on dates. Grafana's own page for CVE-2026-9703 carries a publish date of 27 June 2026, while NVD recorded it on 15 October. The flaw is in Grafana's data source proxy. Loki itself is not vulnerable and does not need patching.
The plugin bug is the one to read carefully. Per the advisory, archives are extracted before the signature is checked, so a valid signature does not stop the write. Grafana Enterprise and OSS share the code.
How to check if you're exposed
Get the version and the plugins first:
curl -s http://grafana.example.internal:3000/api/health
grafana cli plugins ls
env | grep -E "GF_INSTALL_PLUGINS|GF_PLUGINS_PREINSTALL"
Anything installed through grafana cli, GF_INSTALL_PLUGINS or preinstall config uses the vulnerable extractor at install time. If your plugin list is pinned to known names from Grafana's catalog and installed only in your image build, the attack needs an attacker to control what gets installed, which is a supply chain question more than a network one.
For the conditional bugs, read the config:
grep -nE "sync_ttl|auth.proxy|allow_idp_initiated|\[auth.saml\]" /etc/grafana/grafana.ini
If auth.proxy is enabled and sync_ttl is above zero, CVE-2026-14199 applies. If allow_idp_initiated is not true in a SAML setup, CVE-2026-12704 does not apply. If you have no Loki data source, CVE-2026-9703 is moot. The Grafana advisory for CVE-2026-14199 does not list a workaround, so patch rather than relying on setting sync_ttl to zero.
What to do now
- Upgrade to 12.4.13, 13.0.11, 13.1.8 or 13.2.4 on your line. These are the versions the October advisories list as fixed, and they are at or above the September ones.
- Until then, stop installing plugins from archives you did not build yourself. Pin plugin installs in your image, not at container start.
- If you use Auth Proxy with caching, patch this week. Think about who can set the forwarded identity attributes.
- Review who holds Viewer on instances with Loki. Check the Loki ruler for rules you did not create:
curl -s -H "X-Scope-OrgID: tenant1" http://loki.example.internal:3100/loki/api/v1/rules
- Cap request sizes at your reverse proxy for the alerting and provisioning APIs, since CVE-2026-33374 is a missing size limit.
Three of the October items are small on their own. Read only Git Sync access that can change a connection, an Azure Monitor proxy that reaches beyond what Grafana needs, and an API with no size cap are the kind of bugs that turn a low privilege account into a larger one when combined. The Azure one is bounded by the Azure role on the data source's identity, so review that role while you patch.
Why it matters
Grafana sits next to every data source you own. Its service account tokens, data source passwords and cloud identities are exactly what an attacker wants. A bug that lets a Viewer touch rules in another system, or a plugin install that writes a binary, matters beyond the dashboard.
Plugin extraction before signature verification is a pattern worth remembering. Signing only helps if verification comes first. Any tool that unpacks untrusted archives should be treated like a code path that can write anywhere until proven otherwise.
Try it yourself
Run a free scan of the package.json for any plugin you build, or of an SBOM of your Grafana image, at https://gold.safeguard.sh/scan. It runs in the browser, needs no login and the file never leaves your machine. Safeguard also does reachability analysis, which tells you whether your code actually calls a vulnerable function.
Quick check
You only install plugins from the official catalog. Is CVE-2026-15815 still your problem?
Per the advisory, signatures are checked after extraction, so a legitimate looking plugin can still trigger the write. Upgrade to 12.4.11, 13.0.9, 13.1.6 or 13.2.2 or later.
Do you need to patch Loki for CVE-2026-9703?
No. Grafana's advisory says the defect is in the data source proxy and Loki is not vulnerable.
