Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Grafana Labs bug bounty programs

grafana.com Updated

Grafana Labs runs three public programs: a Sorona bug bounty paying up to $1,500, an Intigriti disclosure program with no cash rewards and an Intigriti bug bounty paying up to $15,000 (paused).

Top reward
$1,500
Sorona
Programs
3
2 pay cash
Targets in scope
27
3 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Grafana

Sorona · Pays the most of the 3 programs: up to $1,500.
  • Grafana

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial
  • Grafana Labs - Vulnerability Disclosure Program (VDP)

    Intigriti · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Full
  • Grafana Labs

    Intigriti · Bug bounty

    Paused

    Top reward

    $15k
    Critical
    $15k (highest)
    High
    $7,500 (highest)
    Medium
    $2,000 (highest)
    Low
    $500 (highest)
    Safe harbor
    Full
    First response
    24 hours promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

27 targets across all 3 programs, each listed once with the programs that cover it. 8 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.grafana.com

    Grafana Labs

  • *.grafana.net

    Grafana Labs

  • A deployment an operator deliberately configured with anonymous access, a permissive auth proxy or public dashboards enabled

    Sorona

  • Findings against an unsupported Grafana release, since fixes land on the supported minor versions

    Sorona

  • Grafana Cloud infrastructure, which is a hosted service and a separate asset from the open-source product

    Sorona

  • Loki, Mimir, Tempo and Pyroscope, sibling products in their own repositories with their own advisory streams

    Sorona

  • The data source backends themselves: a defect in Prometheus or Postgres belongs to that project

    Sorona

  • Third-party and community plugins not published by Grafana Labs

    Sorona

Recent changes

Reward and scope changes across every Grafana Labs program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Grafana Labs products, from the NVD.

Search NVD
  • CVE-2026-14199 High

    Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while th

  • CVE-2026-8609 Medium

    An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

  • CVE-2026-8595 Medium

    A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

  • CVE-2026-33382 High

    Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

  • CVE-2026-28378 Low

    The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

  • CVE-2026-42127 High

    The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

  • CVE-2026-9029 High

    A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

  • CVE-2026-42129 High

    A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

About this page

This page gathers every public program listed under grafana.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.