Loading story…
German government CERT advisories reported multiple vulnerabilities in Grafana, the widely used observability and dashboard platform. Two separate dCERT notices identified Grafana as affected, indicating that security issues were disclosed across more than one advisory rather than as a single isolated flaw.
The advisories provide limited public detail, but the repeated notices indicate an ongoing need for organizations running Grafana to review vendor guidance, identify affected versions, and apply available patches or mitigations. Because Grafana is commonly deployed to monitor infrastructure, applications, and security telemetry, unpatched weaknesses could expose sensitive operational data or create opportunities for further compromise depending on the impacted components.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1114 for a Grafana vulnerability that allows information disclosure. This is a separate disclosure event from the earlier Grafana advisories already in the timeline.
dCERT published advisory 2026-0887 covering multiple vulnerabilities in Grafana. This represents a later, separate advisory event related to Grafana vulnerabilities.
dCERT published advisory 2026-0221 for multiple vulnerabilities affecting Grafana. The reference indicates this was a distinct disclosure event by the German CERT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grafana Labs released **Grafana 12.4.2** and issued security updates for the **12.3**, **12.2**, **12.1**, and **11.6** release lines to fix two vulnerabilities tracked as **`CVE-2026-27876`** and **`CVE-2026-27880`**. The company described the issues as **critical** and **high severity**, indicating that multiple supported versions were affected and required immediate remediation. Grafana urged users to upgrade to the newly released patched versions as soon as possible to reduce exposure. The advisory was amplified by security community channels, underscoring the urgency for organizations running self-managed Grafana deployments to identify affected instances and apply the vendor fixes promptly.
Jun 29, 2026
Grafana issued urgent patches for two high-severity vulnerabilities, including **`CVE-2026-27876`**, a critical flaw in the SQL Expressions feature that can allow an attacker with **Viewer** privileges or higher to write arbitrary files to the server and potentially escalate to full **remote code execution**. The issue can be chained into broader compromise scenarios, including unauthorized SSH access, prompting public warnings from national defenders such as Belgium’s CCB to patch immediately. Grafana also fixed **`CVE-2026-27880`**, which affects OpenFeature validation endpoints and allows **unauthenticated** attackers to crash vulnerable instances by sending oversized requests that exhaust memory. Grafana Labs said patched releases, including **12.4.2**, are available and noted that **Amazon Managed Grafana** and **Azure Managed Grafana** were already protected under embargo; for temporary mitigation, administrators were advised to disable the `sqlExpressions` feature toggle and use highly available deployments and reverse proxies such as **Nginx** or **Cloudflare** to restrict request sizes.
Jun 29, 2026
On September 28, 2025, a significant surge in exploitation attempts targeting the Grafana path traversal vulnerability, CVE-2021-43798, was detected by GreyNoise. This vulnerability allows attackers to perform arbitrary file reads on vulnerable Grafana instances, posing a serious risk to organizations using the affected software. Over the course of a single day, GreyNoise observed 110 unique IP addresses attempting to exploit this flaw, all of which were classified as malicious. The majority of these IPs originated from Bangladesh, with 107 IPs traced to that country, while the remaining sources included China and Germany. Of the Bangladesh-based IPs, 105 specifically targeted endpoints in the United States, indicating a focused attack pattern. The destinations of the attacks were limited to three countries: the United States, Slovakia, and Taiwan, with the U.S. being the primary target. The attack traffic followed a consistent ratio across these countries, approximately 3:1:1 for the U.S., Slovakia, and Taiwan, respectively. Analysis of the TCP and HTTP fingerprints revealed that multiple tools were used in the attacks, but all were directed at the same set of targets, suggesting a coordinated campaign rather than random, opportunistic exploitation. Two notable IP addresses from China, both belonging to CHINANET-BACKBONE, were highlighted for their activity on the day of the surge. These IPs were only active on September 28 and were not observed before or after this date, further supporting the theory of a coordinated, time-bound operation. The exploitation activity had been relatively quiet in the months leading up to this event, making the sudden spike particularly noteworthy. GreyNoise's Global Observation Grid (GOG) was instrumental in detecting and analyzing the surge, providing valuable intelligence on the geographic and technical characteristics of the attack. The convergence of attack patterns, source geographies, and tooling points to shared tasking or a common target list among the attackers. Organizations using Grafana are advised to ensure that their systems are patched against CVE-2021-43798 and to monitor for suspicious activity from the identified malicious IPs. The incident underscores the ongoing threat posed by unpatched vulnerabilities in widely used open-source software. Security teams should remain vigilant for similar coordinated exploitation attempts, especially following periods of low activity. The rapid mobilization of a large number of malicious IPs in a single day demonstrates the attackers' ability to coordinate and execute targeted campaigns efficiently. This event highlights the importance of global threat intelligence sharing and proactive vulnerability management. The attack serves as a reminder that even older vulnerabilities can become the focus of renewed exploitation efforts. Organizations should review their exposure to Grafana and implement appropriate network defenses to mitigate the risk of similar attacks.
Jul 23, 2026