Grafana Multiple Vulnerabilities Remote Code Execution Risk

CERT-Bund published security advisory WID-SEC-2026-0899 disclosing multiple critical vulnerabilities in Grafana with a CVSS Base Score of 9.1. The vulnerabilities allow remote, authenticated or anonymous attackers to execute code, cause denial of service, or disclose information. Affected products include all Grafana versions prior to 12.4.0, 12.3.0, 12.2.0, and 12.0.0 running on Linux, UNIX, Windows, and other operating systems.

Organizations running Grafana instances should immediately apply available mitigations and update to the latest patched version (12.4.0 or later). Security teams should assess their Grafana deployments, verify patch status, and monitor for indicators of exploitation. As this is a coordinated security disclosure, no specific compliance deadline is stated but immediate action is recommended given the critical severity rating.