Grafana CVE-2026-28375

The CVSS score of 6.5 reflects a medium-to-high severity denial of service condition with high availability impact. The attack vector is network-based with low complexity and no user interaction required, making exploitation straightforward once an attacker obtains valid credentials. The requirement for low-privilege authentication (PR:L per CVSS vector) is a significant limiting factor, reducing the attack surface to users with legitimate Grafana access or those who can obtain weak credentials. The absence of confidentiality and integrity impacts limits the scope of damage to availability alone. While no EPSS score, CISA KEV status, or public proof-of-concept have been provided in the intelligence data, the combination of low attack complexity, network accessibility, and availability-only impact suggests this is a real but not critical-priority vulnerability suitable for standard patch management timelines. Organizations should prioritize patching based on their credential security posture and the sensitivity of hosted Grafana deployments.

An authenticated Grafana user (e.g., one with a low-privilege viewer or editor role) crafts a specially designed query against the testdata data-source that causes the Grafana backend process to allocate memory without release, causing the server to run out of available RAM and crash. If multiple such queries are submitted or if the attacker has access to automated query scheduling, the denial of service impact can persist or recur, forcing administrators to manually restart services. No public exploit code has been identified, but the low attack complexity and network accessibility mean that once a patch is released, exploitation techniques will likely be rapidly developed by security researchers and adversaries.