zierax/grafana-final-scannerGrafana scanner with all public CVEs that I collected in one script to make grafana testing easier
A command-line vulnerability scanner for Grafana. It fingerprints the installed Grafana version, runs a set of version-aware CVE checks, audits common configuration weaknesses, stores results in a local database, and can serve them through a small web dashboard.
This tool sends requests to Grafana instances and, for some checks, attempts known exploit paths (path traversal, SQL injection, SSRF). Only run it against systems you own or have written permission to test. Unauthorized scanning may violate computer-misuse laws in your jurisdiction.
requestsflask (only required for --serve)pip install -r requirements.txt
# Scan a single target
python scanner.py -u https://grafana.example.com
# Scan a list of URLs from a file
python scanner.py -f targets.txt -o report
# Detect Grafana instances in a mixed URL list, then scan them
python scanner.py --auto-search urls.txt -o discovery
# Persist results to a database and view them in the dashboard
python scanner.py -f targets.txt --db vulndb.json
python scanner.py --serve --db vulndb.json
| Option | Description |
|---|---|
-u, --url | Scan a single target URL |
-f, --file | Scan targets listed one per line in a file |
--auto-search FILE | Detect Grafana in a URL list, then scan detected instances |
-o, --output BASE | Base name for JSON/HTML/CSV report files |
--timeout N | Per-request timeout in seconds (default 10) |
--threads N | Concurrent scan threads (default 5) |
--db FILE | Enable the JSON vulnerability database at the given path |
--serve [PORT] | Start the Flask web dashboard (default port 8080) |
--host | Address the dashboard binds to (default 127.0.0.1) |
--dashboard-token TOKEN | Require this bearer token on all dashboard routes |
--auth-token | Bearer token for scanning authenticated endpoints |
--auth-user / --auth-pass | Basic authentication for scanning |
--no-ssl-verify | Disable TLS certificate verification (prints a warning) |
-v, --verbose | Print per-check detail |
--no-banner | Suppress the startup header |
--no-ssl-verify only for internal
hosts with self-signed certificates; doing so prints a warning because
credentials could otherwise be exposed to interception.--dashboard-token.
When the dashboard is bound to a non-local interface you must set a token.
All state-changing requests also require a CSRF token.With -o, the scanner writes BASE.json, BASE.html, and BASE.csv. The
HTML report neutralizes javascript:/data:/vbscript: URIs that could come
from a malicious target response.
With --db, findings are stored in a JSON file that is written atomically: a
.bak copy of the previous state is kept, and a file that fails to parse is
moved to .corrupt-<timestamp> instead of being silently discarded.
The scanner runs version-aware CVE checks plus configuration audits (security
headers, CORS, anonymous access, self-signup, plugin analysis, exposed
metrics). The full CVE list and detection method notes are in
docs/vulnerabilities.md.
scanner.py — engine, checks, database, web dashboard, CLIdocs/usage.md — scanning modes and workflowsdocs/vulnerabilities.md — CVE referencedocs/architecture.md — internal structure and data flowtests/ — test suitemake test # run the test suite
make lint # ruff + flake8
The CI pipeline runs the tests and linters on Python 3.9–3.12 and builds the Docker image.
MIT. See LICENSE.