Grafana Security Updates – 28 January 2026

The addressed vulnerabilities could allow the remote attacker to gain elevated privileges or perform denial-of-service attacks on the affected systems.

The addressed vulnerabilities:

1. Grafana Cross-Dashboard Privilege Escalation via Permission Management Vulnerability (CVE-2026-21721):

• CVSS: 8.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privilege

2. Grafana Avatar Cache Unauthenticated DoS Vulnerability (CVE-2026-21720):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial-of-Service