Snapshot 227340
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security Grafana Labs protects our users, their data, and the integrity of our platform through proactive security measures, transparent communication, and continuous improvement. Report a VulnerabilityTrust CenterOpens in new tabHall of FameContact Security Our Approach to Security At Grafana Labs, security is fundamental to everything we do. We are committed to protecting our users, their data, and the integrity of our platform through proactive security measures, transparent communication, and continuous improvement. Learn Stay informed about security vulnerabilities, best practices, and updates affecting Grafana products. Guide Access comprehensive security resources and documentation to help secure your Grafana deployment. Trust Verify our commitment through certifications, compliance reports, and transparent security practices. Monitor Track the latest CVE records, security notices, and advisories to protect your environment. Our Certifications ISO 27001 Certified through an independent third-party audit with A-LIGN for ISO 27001 SOC 2 Type 2 Accredited through an independent third-party audit for SOC 2 Type 2 PCI Security Standards Maintains PCI Compliance through third-party approved scanning vendors for the Grafana Labs corporate environment GDPR General Data Protection Regulation Data Processor Agreement (DPA) available Cloud Security Alliance Completed CSA Security Trust Assurance and Risk (STAR) program Security and Compliance Grafana Labs maintains high standards of data privacy and security by implementing: Life Cycle Management of Users (LCM), including Security Training Best practices for internal Data Loss Protection (DLP) Multi-factor authentication (MFA/2FA) Regular infrastructure vulnerability assessments Independent third-party penetration testing and independent audits Grafana Labs development includes continuous integration, detailed change management policies, static code analysis and vulnerability analysis. We implement industry-standard security technologies and procedures to protect our customers' data. View our Trust Portal to access our security reports, certifications and attestations. Security Advisories & CVE Records The latest advisories for Grafana Labs products. Published CVE records Published CVE Severity (CVSS) Advisory Title 2026-10-27 CVE-2026-100105 High (7.7) Alerting contact point authorization bypass via schema downgrade 2026-10-27 CVE-2026-88967 High (7.7) Azure Monitor access token disclosure via SSRF 2026-10-27 CVE-2026-88858 Medium (6.5) Server-side expression parser denial of service 2026-10-27 CVE-2026-103506 High (8.9) SSO settings authorization bypass 2026-10-13 CVE-2026-93294 Medium (6.3) Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs View all security advisories Security Hall of Fame Recent researcher credits for responsibly disclosed vulnerabilities. October 27, 2026 CVE-2026-88967 Responsibly disclosed by rathina October 27, 2026 CVE-2026-103506 Responsibly disclosed by kazuki-hanai October 14, 2026 CVE-2026-76154 Responsibly disclosed by Eric Sowah Badger (niihack) September 30, 2026 CVE-2026-81841 Responsibly disclosed by Yeonoh Park @ CIS Lab, SeoulTech September 30, 2026 CVE-2026-13719 Responsibly disclosed by mon3m View the full Hall of Fame Security Notices Updates and notices from the Grafana Labs security team. October 23, 2026 PHP2Shell update (Oct. 23, 2026) Grafana Labs not affected by PHP2Shell Recent Security Blog Posts Stay informed with the latest security updates, analyses, and best practices from the Grafana Labs team. June 23, 2026 Post-incident review for TanStack npm supply chain ransom incident: No unauthorized access to customer production systems We completed our internal investigation of the recent TanStack supply chain ransom incident and confirmed our initial findings: The incident was strictly limited to the Grafana Labs GitHub environment. There was no unauthorized access to customer production systems, and the Grafana Cloud platform was not affected. Read more about our incident response and remediation. May 19, 2026 Grafana Labs security update: Latest on TanStack npm supply chain ransomware incident Grafana Labs confirmed a targeted attack by a cybercrime group that gained unauthorized access to our GitHub repositories and downloaded our codebase. Here is the latest update about our investigations. March 26, 2026 Grafana security release: Critical and high severity security fixes for CVE-2026-27876 and CVE-2026-27880 Today we are releasing Grafana 12.4.2 along with security patches for Grafana 12.3, 12.2, 12.1, and 11.6, which include critical and high severity security fixes. We recommend that you install the newly released versions as soon as possible. Found a security issue? Report a vulnerability or reach our security team directly. Report a Vulnerability