Grafana Security Review
A Grafana data source runs every query with its own configured credentials, not the viewer’s. We test organisations, roles, data source permissions and dashboard sharing. CREST-certified testers, fixed price from £2,670 for a 2-day single-instance scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Grafana’s three basic organisation roles, Viewer, Editor and Admin, apply globally across every dashboard, alert and data source in that organisation.
A Grafana instance is only as locked down as the organisations, roles and data source permissions your team configured
Grafana’s own documentation on roles and permissions sets out three organisation roles, Viewer, Editor and Admin, and confirms that permission level is global: an Editor can see and update every dashboard in the organisation unless a folder’s own permissions restrict it. A separate Grafana server administrator role manages server-wide settings such as licences and organisation creation, and Grafana itself notes that this Grafana Admin role does not exist at all on Grafana Cloud, where that responsibility moves to your own organisation administrators.
By default, any user in an organisation can issue any query a data source supports, not just the queries that already appear on dashboards they can see, because the data source proxy runs with its own configured credentials rather than the viewer’s own. Grafana Enterprise and Grafana Cloud can restrict this with data source permissions set to Query, Edit or Admin against specific users, teams or roles, and the Admin level also controls who can toggle query caching for that data source. We test who can query each data source today, and whether Enterprise or Cloud data source permissions have actually been configured to narrow that default.
We review the organisations, teams, roles, data source permissions, dashboard sharing settings and service accounts configured on your own Grafana instance, the same way we review configuration on a database platform rather than the database engine itself. We never test Grafana’s own codebase or attempt to find vulnerabilities in the open-source project.
SCOPE
What we review on a single Grafana instance
Organisations and Global Permission Scope
Every Grafana user belongs to at least one organisation, and organisation role-based permissions are global within it: Grafana’s documentation confirms a permission level applies to every dashboard, alert, playlist, data source, team and service account in that organisation rather than to individual resources. A single instance can run multiple organisations to separate teams or business units entirely, but a user given the wrong role in the wrong organisation inherits everything that role can reach across the whole organisation at once. We test which organisations exist, who belongs to each one, and whether role assignments actually match the separation the business intended.
Basic Roles: Viewer, Editor and Admin
Grafana assigns every organisation user one of three basic roles, Viewer, Editor or Admin, and its documentation is explicit that an Editor can see and update every dashboard in the organisation unless it sits in a folder with its own restrictive permissions. A separate Grafana server administrator (Grafana Admin) role manages instance-wide settings, statistics and organisation creation, and Grafana notes this role does not exist on Grafana Cloud at all. We test which basic role each user actually holds, whether folder permissions genuinely narrow an Editor’s reach, and who holds server administrator rights where that role exists.
Teams and Grouped Permissions
Grafana Teams let permissions be granted to a group of users at once instead of one user at a time, which is how dashboard and folder access is scaled as headcount grows. A team keeps whatever access it has been granted directly, so a team built for a past project, migration or contractor engagement can retain live access nobody has reviewed since. We test which teams exist, what each one is actually bound to, and whether a stale team still grants access the business no longer intends.
Data Source Permissions and the Query Proxy
Grafana documents that, by default, data sources in an organisation can be queried by any user in it, including a Viewer, who can issue any possible query the data source supports rather than only the queries that already exist on dashboards they can see; this works because the data source proxy runs queries with its own configured credentials, not the viewer’s own. Grafana Enterprise and Grafana Cloud let you restrict this with data source permissions set to Query, Edit or Admin against specific users, teams or roles, with the Admin level also controlling who can enable or disable query caching. We test what each data source can actually be queried for by whom, and whether Enterprise or Cloud permissions have been configured to narrow that default.
Dashboard Sharing and Public Dashboards
Sharing a dashboard externally as Anyone with the link makes Grafana display a confirmation that the entire dashboard will become public, after which anyone holding that link can view it until access is paused or revoked; Grafana’s documentation also lists internal links, snapshots, PDF, image and JSON export among the other ways a dashboard’s data can leave the permission model that protects it inside the organisation. Enabling annotations on a public dashboard can surface annotations from other dashboards in the organisation where tag-based annotation queries are used, which Grafana flags as a limitation of the feature. We test which dashboards have been shared publicly, whether that sharing is still required, and what a public link actually exposes beyond the dashboard it was created for.
Anonymous Access
Anonymous access is switched on with the auth.anonymous block in Grafana’s configuration, which sets the organisation and the role, Viewer, Editor or Admin, that every unauthenticated visitor assumes; Grafana notes this feature is only available on Grafana Enterprise self-managed and Grafana Open Source, not on Grafana Cloud. A device_limit setting can cap how many anonymous devices are allowed, but nothing in the feature itself distinguishes a trusted internal visitor from anyone else who can reach the login page. We test whether anonymous access is enabled, which role it grants, and what an unauthenticated visitor can actually reach as a result.
Service Accounts and API Keys
Grafana positions service accounts as the replacement for API keys when authenticating applications such as Terraform or dashboard provisioning scripts against the Grafana API, because a service account can be enabled, disabled or granted role-based permissions and stays active until deleted, while an API key is only ever valid until its fixed expiry date. Service account tokens are not tied to a specific user, so they keep working even if the Grafana user who created them is later removed, and a service account is scoped to the single organisation it was created in. We test which service accounts and legacy API keys still exist, what permissions each token actually carries, and whether any have outlived the automation they were created for.
Default Admin Account
Grafana’s [security] configuration block sets the default server administrator username to admin and its password to admin on first run, generated once and expected to be changed immediately afterwards; disable_initial_admin_creation can suppress that account entirely where it is not wanted. Because this is a documented, predictable default rather than a randomly generated secret, an instance that has never had its first-run admin credential rotated is reachable by anyone who knows the product. We test whether the default admin credential has been changed, and what that account can reach if it has not.
Plugins
Grafana checks every plugin for a valid signature when it loads, distinguishing signed plugins from unsigned ones, and the Frontend Sandbox can isolate a plugin’s frontend code in its own JavaScript context so it cannot modify the rest of the Grafana interface or interfere with other plugins. An unsigned or unmaintained plugin still runs with the same access to dashboards and data sources as any core Grafana feature once installed. We test which plugins are installed, whether any are unsigned, and what access a plugin actually has within the instance.
Grafana Cloud vs Self-Hosted
Several controls this page covers work differently depending on where Grafana runs: the Grafana Admin server administrator role does not exist on Grafana Cloud at all, Grafana Support is not authorised to change organisation roles on Cloud instances, anonymous access is not available on Cloud, and provisioned or Cloud-managed data sources are read-only in the UI regardless of the data source permissions configured against them. A self-managed instance carries the operational responsibility for all of these settings directly, while a Cloud organisation depends on Grafana Cloud’s own support processes for some of them. We confirm which of these differences apply to your instance before scoping the engagement.
OUR PROCESS
Grafana Security Review: From Scope to Attestation
Scope and Access
We agree which Grafana organisation, teams and data sources are in scope, plus at least one login for each basic role and any service accounts in use.
Role and Permission Mapping
We map every organisation role, team, data source permission and public dashboard against the access it actually grants.
Manual Testing
A CREST-certified tester manually tests role boundaries, data source permissions, public dashboard exposure, anonymous access and service account tokens, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Grafana pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Grafana Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Grafana For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Grafana Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Grafana instance?
We need at least one login for each basic role in use, ideally a Viewer or Editor account rather than an organisation Admin, plus a service account token if automation is in scope. Read access to your current teams and data source permissions speeds up scoping but isn’t needed to start.
Will testing touch our live data?
Testing focuses on organisations, roles, data source permissions, dashboard sharing and service accounts rather than the metrics, logs or traces a data source returns. Where proving a finding needs a test query or a temporary public dashboard, we agree the exact scope with you first and remove anything we create once testing is complete.
Is this hosted on our infrastructure or Grafana’s?
Grafana runs either self-managed on your own infrastructure or as a managed organisation on Grafana Cloud, and several controls, including the server administrator role and anonymous access, behave differently between the two. We confirm which model applies to your instance during scoping and test the configuration you actually control.
How long does a Grafana security review take?
A single instance with a typical set of organisations, teams and data sources sits in our 2-day single-instance scope, with a report landing around 5 working days after kickoff. An instance running many organisations, a large number of data sources, or Enterprise-level data source permissions extends that scope.
What is out of scope for a single-instance review?
Testing Grafana’s own source code or the underlying data sources it queries, such as a database or observability backend, is not included, and we do not run denial-of-service testing against the Grafana server. A connected data source’s own security review is scoped and quoted separately.
Do you need our source code or admin access?
No. We test with the role accounts and access you provide, and we do not need standing organisation Admin or server administrator access beyond what is needed to verify a specific finding during the engagement.
Does Grafana Labs have a policy on customer penetration testing?
Self-managed Grafana is software you run yourself, so there is no vendor notification process to follow before testing your own instance, and a genuine vulnerability in Grafana’s own code is reported through Grafana Labs’ published security advisories instead. Grafana Cloud is Grafana Labs’ own hosted platform, so we confirm Grafana Labs’ current customer security-testing terms for it during scoping.
Are your testers CREST certified?
Yes. Every Grafana engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Grafana instance
A Grafana data source runs every query with its own configured credentials, not the viewer’s. We test organisations, roles, data source permissions and dashboard sharing. CREST-certified testers, fixed price from £2,670 for a 2-day single-instance scope, quoted within 24 hours.
