Grafana OSS CVE-2026-28376

An authenticated Grafana user account is required - the CVSS vector PR:L confirms low-privilege credentials suffice; unauthenticated exploitation is not possible. The attacker must have network access to the Grafana Live push API endpoint, which is part of the standard Grafana HTTP server surface and not a separately opt-in feature in affected versions. No non-default configuration is required: Grafana Live is enabled by default in Grafana 8.0 and later. Exploitation is limited by: (1) the mandatory authenticated session - anonymous or pre-auth exploitation is ruled out by PR:L; (2) the 'Automatable: no' SSVC rating, indicating that scripted mass exploitation across many targets without per-target authentication is not straightforward; (3) impact is scoped to availability only (S:U, C:N, I:N), so confidentiality and integrity are not at risk. The primary realistic threat actor is a malicious or compromised insider/low-privilege user within an organization's Grafana deployment.

CVSS scores this at 6.5 (Medium), driven entirely by the A:H availability impact against a network-accessible endpoint with low-privilege authentication - there is no confidentiality or integrity risk. The PR:L requirement is a meaningful limiting factor: the attacker must hold a valid Grafana account, ruling out unauthenticated internet-scale exploitation. EPSS at 0.04% (12th percentile) is very low, consistent with SSVC's 'Exploitation: none' and 'Automatable: no' assessments, indicating no observed mass exploitation tooling. The 'not automatable' SSVC rating likely reflects the per-session authentication prerequisite. Real-world priority is elevated for multi-tenant Grafana deployments (SaaS, shared enterprise instances) where untrusted or potentially adversarial authenticated users exist - in those environments, a single low-privileged account can take down the shared instance. For single-tenant or internally-controlled deployments with trusted users only, practical risk is substantially lower despite the network vector. No CVSS/description conflict identified; signals are internally consistent.

An attacker with a valid low-privilege Grafana account (e.g., a Viewer-role user in a shared enterprise instance) crafts an HTTP request targeting the Grafana Live push endpoint and streams a continuously growing request body without a terminating boundary. The Grafana server allocates heap memory to buffer the incoming data without enforcing a size ceiling, consuming available RAM until the process is killed by the OS OOM killer or the system becomes unresponsive, effectively denying service to all other Grafana users on that instance. No public proof-of-concept has been identified, but the attack technique requires only standard HTTP client tooling and authenticated credentials.