Grafana OSS CVE-2026-28383

Exploitation requires a valid authenticated session in Grafana with at least low-privilege access (confirmed by CVSS PR:L). The attacker must be able to reach the Grafana plugin resources HTTP endpoint over the network (AV:N, AC:L). No special plugin configuration or non-default feature flag is specified as a prerequisite in the available advisory data - the plugin resources endpoint appears to be a standard Grafana component. Exploitation is limited by the authentication requirement (anonymous or unauthenticated access is insufficient), and the SSVC 'automatable: no' rating indicates reliable triggering of an OOM condition requires payload tuning rather than a single-shot generic request. The scope is limited to the Grafana process itself (S:U), so host OS compromise is not a direct outcome.

Several signals collectively indicate this is a low-to-moderate real-world priority despite the CVSS 6.5 base score. The CVSS vector requires PR:L (low-privilege authenticated access), ruling out unauthenticated mass exploitation. The EPSS score of 0.04% at the 12th percentile is very low, suggesting minimal observed or anticipated exploitation activity. SSVC assessment corroborates this: exploitation status is 'none', automatable is 'no' (contradicting the AC:L CVSS attribute - likely because triggering a meaningful OOM condition requires tuning payload size and timing, making automated mass exploitation impractical), and technical impact is 'partial'. The vulnerability is not listed in the CISA KEV catalog. The primary realistic risk is an insider threat or a compromised low-privilege account being used to disrupt Grafana availability. Organizations heavily reliant on Grafana for operational monitoring should treat this with elevated urgency due to the availability dependency, even if broad exploitation is unlikely.

An authenticated Grafana user - even one holding only the default Viewer or Editor role - crafts an HTTP POST or PUT request with an arbitrarily large body and sends it to the Grafana plugin resources endpoint. The Grafana backend allocates memory proportional to the full request body size without bounds, and with sufficient request size or repeated requests, exhausts available system memory, causing the Grafana process to be killed by the OS OOM killer or become unresponsive. No public proof-of-concept code has been identified at time of analysis.