Loading story…
Grafana Labs released Grafana 12.4.2 and issued security updates for the 12.3, 12.2, 12.1, and 11.6 release lines to fix two vulnerabilities tracked as CVE-2026-27876 and CVE-2026-27880. The company described the issues as critical and high severity, indicating that multiple supported versions were affected and required immediate remediation.
Grafana urged users to upgrade to the newly released patched versions as soon as possible to reduce exposure. The advisory was amplified by security community channels, underscoring the urgency for organizations running self-managed Grafana deployments to identify affected instances and apply the vendor fixes promptly.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Grafana announced Grafana 12.4.2 and security patch releases for Grafana 12.3, 12.2, 12.1, and 11.6 to address critical- and high-severity vulnerabilities tracked as CVE-2026-27876 and CVE-2026-27880. The company urged users to upgrade as soon as possible to remediate the issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
grafana.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German government CERT advisories reported **multiple vulnerabilities in Grafana**, the widely used observability and dashboard platform. Two separate dCERT notices identified Grafana as affected, indicating that security issues were disclosed across more than one advisory rather than as a single isolated flaw. The advisories provide limited public detail, but the repeated notices indicate an ongoing need for organizations running Grafana to review vendor guidance, identify affected versions, and apply available patches or mitigations. Because Grafana is commonly deployed to monitor infrastructure, applications, and security telemetry, unpatched weaknesses could expose sensitive operational data or create opportunities for further compromise depending on the impacted components.
Jun 29, 2026
Grafana issued urgent patches for two high-severity vulnerabilities, including **`CVE-2026-27876`**, a critical flaw in the SQL Expressions feature that can allow an attacker with **Viewer** privileges or higher to write arbitrary files to the server and potentially escalate to full **remote code execution**. The issue can be chained into broader compromise scenarios, including unauthorized SSH access, prompting public warnings from national defenders such as Belgium’s CCB to patch immediately. Grafana also fixed **`CVE-2026-27880`**, which affects OpenFeature validation endpoints and allows **unauthenticated** attackers to crash vulnerable instances by sending oversized requests that exhaust memory. Grafana Labs said patched releases, including **12.4.2**, are available and noted that **Amazon Managed Grafana** and **Azure Managed Grafana** were already protected under embargo; for temporary mitigation, administrators were advised to disable the `sqlExpressions` feature toggle and use highly available deployments and reverse proxies such as **Nginx** or **Cloudflare** to restrict request sizes.
Jun 29, 2026
Grafana has addressed a critical security vulnerability (CVE-2025-41115) in its Enterprise platform, specifically affecting the System for Cross-domain Identity Management (SCIM) component. The flaw, rated with a maximum CVSS score of 10.0, allows a malicious or compromised SCIM client to provision users with numeric external IDs, potentially overriding internal user IDs and enabling privilege escalation or user impersonation. Exploitation requires both the `enableSCIM` feature flag and the `user_sync_enabled` configuration to be set to true. The vulnerability impacts Grafana Enterprise versions 12.0.0 to 12.2.1 and has been resolved in versions 12.0.6+security-01, 12.1.3+security-01, 12.2.1+security-01, and 12.3.0. The issue was discovered internally by Grafana during an audit on November 4, 2025, and prompted immediate patch releases due to its severity. Security advisories from multiple sources urge administrators to apply the updates promptly to mitigate the risk of privilege escalation and user impersonation attacks. Organizations using affected versions with SCIM provisioning enabled are strongly advised to review their configurations and update to the patched releases without delay.
Jun 29, 2026