Vulnerability Database · Go · Package report

github.com/grafana/grafana: vulnerability history, versions and safety

github.com/grafana/grafana is a package in the Go ecosystem. Vulert records 117 vulnerabilities for it across 120 releases, from Oct 2021 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
117 vulnerabilities recorded C7 H20 M40 L3 U47
i
49 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
22 in the last 12 months

Most recent disclosure 07 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

Vulert verdict on github.com/grafana/grafana v6.1.6+incompatible i

Updated on 23 Oct 2026

Careful: 49 of the 117 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 64/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Plan around the 49 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v6.1.6+incompatible — unaffected i
  • Vulnerabilities on record 117 over 5 years · 22 in the last year i
  • Latest disclosure 07 Oct 2026 i
  • Highest CVSS 10.0 i
  • With no published fix 49 i
  • Stars 77,421 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence AGPL-3.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/grafana/grafana, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022161221-5f006c273116 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022160815-4cf34624d269 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022160046-3f82de3fbb4d 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022155744-097fd74317f8 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022154235-26c686ab0b92 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022153718-c194b6704374 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022152613-9bb505592373 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022152218-7816dbb53226 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022152004-97410215d82c 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022150520-912245a8bf8b 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022145822-3420e13ba94e 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022145140-02d0b0c25f3e 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022140902-54e627e0ac0d 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022140441-689a0b33d657 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022135627-c630921012ba 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022135143-825d37210169 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022134345-0e70bc3a124d 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022132614-eaa78857ba8a 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022132505-71f3db91e990 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022132111-51b230f1ad18 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022131455-ba36a22d99f8 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022131000-36be0c89ce1b 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022130826-37e766c979e7 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022130410-464d00949634 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022130001-38d89a488635 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022125402-c1d9cc4b47a2 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022124740-35070feb38a3 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022121617-811e0c01ae4a 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022115852-08d2daecfb99 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022115448-e943456bc5ac 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022112406-d4db0470ffc0 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022111810-5e135cda7600 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022110510-bc4b32aabb47 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022105953-9f8e114e900a 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022103556-f63ee8a407bc 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022100809-7d44f6fc1a36 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022093323-eafb3a779529 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022090320-8f7032889aa5 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022083642-bac934f04259 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022082404-32f4f103c56c 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022081600-c83d45771f8a 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022075637-614b8dc7831a 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022075426-361ff4bb5262 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022074733-47e674de3e5c 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022074325-96de1918a0d4 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022073518-6fbfae675bc2 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022072652-50c0ef6afae6 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022070800-f7e65c6c628a 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022070520-3e9745e5013f 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022062346-756fe9280061 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261022000032-e40de7898e1c 22 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021234007-7fea201d0f4a 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021214819-0be7d5b210a4 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021213950-1333a47e22d1 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021203454-7de573e4db63 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021203333-fe9934b67e75 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021201250-770a08e1623c 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021183623-75d6810efccb 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021182126-80c3bc368425 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021173741-7bec0f27f4c9 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021173316-4451964cd8fb 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021171006-657a531e9387 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021164740-567e34cbc275 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021163025-b36eea198358 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021150956-ce73ac3b2a88 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021144358-2db8025937b1 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021141928-a9ae7fe4db68 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021132817-2351b7e52b43 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021123430-36a15b576605 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021102316-6a9a24118330 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021090313-2a6ca876e676 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021075621-0166366eca50 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021074216-880394810330 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021070621-202784072c7d 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021065453-2324b5584ee6 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021060811-30770908902a 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021050358-2ae86760faa2 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261021000312-951a0b83aa69 21 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020234119-1bc638c7e51f 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020225302-356ba5e88d2a 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020222056-215f14835c73 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020215243-cd381de7b778 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020202144-3025c5a4a0a8 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020191559-719d0606b76b 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020185114-0749faeffc63 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020183503-84225fd19cb3 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020183033-073b06875b15 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020181921-67dfa31b3590 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020175243-330f73c238f9 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020172358-687fda65038e 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020172231-f4c59309c125 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020171509-65dab7ff6532 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020170449-d9e2333ca18b 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020170254-b5988fe1377c 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020165156-1c052066a899 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020161824-82bd83244971 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020160225-7c22c85a8943 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020155000-014e4273a716 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020154101-248b37fe422e 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020153535-2592f402d92c 20 Oct 2026 C1 H5 M20 L2 U43 AGPL-3.0 No Details →
v0.0.0-20261020152336-1eaf0f98b4f2 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020151239-307dbbe93db6 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020145613-59f69a98ab53 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020143145-91cca2a201de 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020140157-a0a372417c65 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020134258-993782cdb6bf 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020132528-b1b14fda9fcb 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020120702-e844a74d7795 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020114755-98f61fe4eb84 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020113019-11c0ea3d7cb9 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020105514-262d614bce85 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020103710-a3e6d0b1abb7 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020084823-804159455cc6 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020084327-42bf57e61033 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020083343-57bca96f71ef 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020080901-976ae3ce4259 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020080127-5935120d439e 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020073648-fb941c457f88 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020071705-1199f3519e8c 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →
v0.0.0-20261020070610-f57aaab70929 20 Oct 2026 C1 H5 M20 L2 U43 — No Details →

The newest 120 of 20,320 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 12
  • 2023 11
  • 2024 57
  • 2025 16
  • 2026 20

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 22 of the 117 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/grafana/grafana

The 5 most severe of 117 vulnerabilities recorded for this package

Search all 117 in the database →

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/grafana/grafana

Is github.com/grafana/grafana safe to use?

Vulert records 117 vulnerabilities for github.com/grafana/grafana in Go: 7 critical, 20 high, 40 medium and 3 low, plus 47 not yet rated. 49 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/grafana/grafana's Vulert package health score?

Vulert scores github.com/grafana/grafana 64/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

How many vulnerabilities does github.com/grafana/grafana have?

117 vulnerabilities are recorded for github.com/grafana/grafana in the Go ecosystem: 7 critical, 20 high, 40 medium and 3 low, plus 47 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/grafana/grafana vulnerabilities disclosed?

22 vulnerabilities were recorded for github.com/grafana/grafana in the last 12 months, and the oldest entry in this database dates to 05 Oct 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/grafana/grafana are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/grafana/grafana for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/grafana/grafana version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.