- 241/2026
- High
Grafana has released security updates to fix several vulnerabilities affecting Grafana, Loki, and Grafana MCP products.
The addressed vulnerabilities could allow the attacker to conduct denial-of-service attacks, gain elevated privileges, obtain sensitive information, perform server-side request forgery, and cross-site scripting attacks on the affected systems.
Sample of the addressed vulnerabilities:
1. Grafana MCP Server-Side Request Forgery Vulnerability (CVE-2026-15583):
- CVSS: 8.6
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Server-Side Request Forgery
2. Loki Detected_Fields Query Limits Results in Unbounded Memory Allocation Vulnerability (CVE-2026-21729):
- CVSS: 7.5
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Denial of Service
Vulnerabilities
- CVE-2026-15583
- CVE-2026-21729
- CVE-2026-11769
- CVE-2026-33382
- CVE-2026-42129
- CVE-2026-10601
- CVE-2026-8609
- CVE-2026-42127
- CVE-2026-9029
- CVE-2026-8595
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.