Skip to content
COOEY

FAIL › dossier

Grafana Labs

VENDOR

· dossier confidence 40%

Grafana Labs is a private Swedish observability-platform vendor with a mixed security posture marked by high-severity unpatched vulnerabilities exploited in the wild, including authentication bypasses and path traversal flaws.

Failure events
2
Zero-days
0
RCEs
1
On KEV
2
Critical
0
Worst shame
90
PROFILE
Categoryobservability-platform-vendorWhat they doGrafana Labs develops and maintains the Grafana observability platform, including dashboards, Loki for logs, Tempo for traces, and Mimir for metrics, supporting both on-prem and SaaS deployments for DevOps and engineering teams.HQStockholm, Sweden Websitehttps://grafana.com ↗
SECURITY POSTURE

The company has a mixed track record with high-severity unpatched vulnerabilities exploited in the wild, including authentication bypasses and path traversal flaws, indicating potential gaps in vulnerability management and patching cadence.

Notable failures
  • CVE-2021-39226 unpatched authentication bypass
  • CVE-2021-43798 unpatched path traversal exploited in the wild
Patterns: repeated unpatched high-severity vulnerabilities; path traversal and authentication bypass flaws
FAILURE HISTORY · 4
DATEEVENTSEVSUMMARY
2022-08-25 CVE-2021-39226 high Grafana suffered an unpatched authentication bypass allowing unauthenticated users to delete snapshots, potentially leading to data loss.
2022-08-25 CVE-2021-39226 high Grafana suffered an unpatched authentication bypass allowing unauthenticated users to delete snapshots, potentially leading to data loss.
2025-10-09 CVE-2021-43798 high Grafana Labs' Grafana had an unpatched path traversal vulnerability exploited in the wild, allowing unauthorized access to local files.
2025-10-09 CVE-2021-43798 high Grafana Labs' Grafana had an unpatched path traversal vulnerability exploited in the wild, allowing unauthorized access to local files.
DOSSIER SOURCES
Open questions: Exact founding year not explicitly in provided evidence · Exact employee count not explicitly in provided evidence
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-24 03:50:12.686590+00:00