Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl
    greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity
    attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who
    shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is
    live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
    (CVE-2026-14199)

  - When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the
    InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay
    protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session
    as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this
    setting is off by default and Grafana OSS is not affected. (CVE-2026-12704)

  - An authenticated user can list alert rules stored in folders they are not allowed to read through the
    alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction
    was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can
    trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not
    exposed. (CVE-2026-13719)

  - An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and
    grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these
    fields were stored without an authorization check. The dashboard then appears file-provisioned, and
    administrators can no longer update or delete it through Grafana. The impact is limited to the same
    organization and no data is exposed. (CVE-2026-13720)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2136:30 advisory.

    * grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION     (CVE-2026-15815)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792757203 advisory.

  - Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.
    A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation     directory, writing arbitrary files and an executable backend binary outside that directory. The dropped     executable runs with the privileges of the Grafana server process, resulting in remote code execution.
    Plugin archives are extracted before their signature is verified, so a valid plugin signature does not     prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate,     as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS     environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the     same plugin extraction code as Grafana OSS. (CVE-2026-15815)

  - Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and     5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(),     Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
    (CVE-2026-29063)

  - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body     before processing it. An attacker can send very large payloads that force excessive memory allocation,     potentially exhausting memory and causing a denial of service. (CVE-2026-33382)

  - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-     yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of     mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions     3.15.0 and 4.3.0. (CVE-2026-59869)

  - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1,     maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while     processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge     targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource     limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in     applications that parse untrusted YAML, and merge processing is enabled by default on these release lines.
    In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions     3.15.2, 4.3.2, and 5.4.1. (CVE-2026-84375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142362 advisory.

    Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when     extracting plugin archives. A crafted plugin archive can chain relative symbolic link     entries to escape the plugin installation directory, writing arbitrary files and an     executable backend binary outside that directory. The dropped executable runs with the     privileges of the Grafana server process, resulting in remote code execution.

    Plugin archives are extracted before their signature is verified, so a valid plugin     signature does not prevent the write. An operator can therefore be affected by     installing a plugin that appears legitimate, as well as by installing a plugin from an     arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or     preinstall configuration.

    Grafana Enterprise is affected because it includes the same plugin extraction code as     Grafana OSS.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_83544 advisory.

    * grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION     (CVE-2026-15815)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:83544 advisory.

    * grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION     (CVE-2026-15815)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-83544 advisory.

    - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520]
    - CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
    - CVE-2026-42504 grafana: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhel-9.8.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83544 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION     (CVE-2026-15815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:83544 advisory.

    * grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION     (CVE-2026-15815)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1054 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-93450:
    go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing     and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can     submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack     overflow that terminates the process and all in-flight requests.

    CVE-2026-15815:
    Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.
    A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation     directory, writing arbitrary files and an executable backend binary outside that directory. The dropped     executable runs with the privileges of the Grafana server process, resulting in remote code execution.
    Plugin archives are extracted before their signature is verified, so a valid plugin signature does not     prevent the write.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.
    A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation     directory, writing arbitrary files and an executable backend binary outside that directory. The dropped     executable runs with the privileges of the Grafana server process, resulting in remote code execution.
    Plugin archives are extracted before their signature is verified, so a valid plugin signature does not     prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate,     as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS     environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the     same plugin extraction code as Grafana OSS. (CVE-2026-15815)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
371653	MiracleLinux 8 : grafana-9.2.10-35.el8_10 (AXSA:2026-2136:30)	Nessus	Miracle Linux Local Security Checks	Local	high
371221	AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792757203)	Nessus	Alma Linux Local Security Checks	Local	high
370112	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana (UTSA-2026-142362)	Nessus	Unity Linux Local Security Checks	Local	high
366771	Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2026_83544)	Nessus	Rocky Linux Local Security Checks	Local	high
366492	RockyLinux 8 : grafana (RLSA-2026:83544)	Nessus	Rocky Linux Local Security Checks	Local	high
366311	Oracle Linux 8 : grafana (ELSA-2026-83544)	Nessus	Oracle Linux Local Security Checks	Local	high
366225	RHEL 8 : grafana (RHSA-2026:83544)	Nessus	Red Hat Local Security Checks	Local	high
366105	AlmaLinux 8 : grafana (ALSA-2026:83544)	Nessus	Alma Linux Local Security Checks	Local	high
353448	TencentOS Server 4: grafana (TSSA-2026:1054)	Nessus	Tencent Local Security Checks	Local	high
353332	Linux Distros Unpatched Vulnerability : CVE-2026-15815	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-15815

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high