grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

An authorization error has been discovered in Grafana dashboards. The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a user who has permission management rights on one dashboard can read and modify permissions ...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 grafana/grafana/pkg/services/dashboards: Grafana...

GHSA-848J-6MX2-7J84 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, opensearch-dashboards, opensearch-dashboards-fips, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, librechat...

GHSA-848J-6MX2-7J84 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, opensearch-dashboards, opensearch-dashboards-fips, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, librechat...

CVE-2026-25639 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, prism, opensearch-dashboards, saf, jitsucom-jitsu, langfuse, nextcloud-server, kubeflow-centraldashboard, lerna...

GHSA-43FC-JF86-J433 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, prism, opensearch-dashboards, saf, jitsucom-jitsu, langfuse, nextcloud-server, kubeflow-centraldashboard, lerna...

SUSE CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

GHSA-345P-7CG4-V4C7 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-25536 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-21722

A flaw was found in Grafana. Public dashboards with annotations enabled fail to limit their annotation time range to the locked time range of the public dashboard. This flaw allows an attacker to retrieve the entire history of annotations visible on that dashboard, including those outside the...

CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

UBUNTU-CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-21722 Public Dashboards time range restriction on annotations can be bypassed

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-21722

Grafana CVE-2026-21722 affects the public dashboards annotations feature. The vulnerability allows a user to read the entire annotation history visible on a dashboard when timerange locking is disabled, exposing history outside the locked timerange. Root cause is that annotation timeranges were n...