CVE-2026-28376

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-28376	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana:11.6.14:-::::::
	cpe:2.3:a:grafana:grafana:11.6.14:security01::::::
	cpe:2.3:a:grafana:grafana:12.2.8:-::::::
	cpe:2.3:a:grafana:grafana:12.2.8:security01::::::
	cpe:2.3:a:grafana:grafana:12.3.6:-::::::
	cpe:2.3:a:grafana:grafana:12.3.6:security01::::::
	cpe:2.3:a:grafana:grafana:12.4.3:-::::::
	cpe:2.3:a:grafana:grafana:13.0.0:::::::*
	cpe:2.3:a:grafana:grafana:13.0.1:-::::::

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) El punto de conexión push de Grafana Live puede ser explotado para causar una asignación de memoria ilimitada enviando un cuerpo de solicitud grande o en streaming, lo que podría llevar a condiciones de falta de memoria. Un usuario autenticado con acceso a la API de Grafana Live puede desencadenar este problema.

Information

Published : 2026-05-13 20:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-28376

Mitre link : CVE-2026-28376

CVE.ORG link : CVE-2026-28376

JSON object : View

Products Affected

grafana

grafana

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-28376", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28376", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T18:10:50.762919Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "11.6.14", "lessThan": "11.6.14+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.2.8", "lessThan": "12.2.8+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.3.6", "lessThan": "12.3.6+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "12.4.3", "lessThan": "12.4.3+security-02", "versionType": "custom"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}, {"status": "affected", "version": "13.0.1", "lessThan": "13.0.1+security-01", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-13T20:16:19.760", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-28376", "tags": ["Vendor Advisory"], "source": "security@grafana.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue."}, {"lang": "es", "value": "El punto de conexi\u00f3n push de Grafana Live puede ser explotado para causar una asignaci\u00f3n de memoria ilimitada enviando un cuerpo de solicitud grande o en streaming, lo que podr\u00eda llevar a condiciones de falta de memoria. Un usuario autenticado con acceso a la API de Grafana Live puede desencadenar este problema."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E135E10-C076-4250-A33D-ACFE7A77DB9D", "versionEndExcluding": "11.6.14", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80B49F3F-8139-4DEB-971F-1B4F05BDE98E", "versionEndExcluding": "12.2.8", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5", "versionEndExcluding": "12.3.6", "versionStartIncluding": "12.3.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A", "versionEndExcluding": "12.4.3", "versionStartIncluding": "12.4.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F"}, {"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4"}, {"criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440"}, {"criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}