EUVD-2026-16598Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unbounded payload to feature toggle endpoint
-
ExploitParser allocates unlimited memory
-
ExecutionOut-of-memory condition triggered
-
ImpactService crashes
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit OpenFeature feature toggle evaluation endpoint by sending unbounded values via network request. No authentication, user interaction, or special configuration required. Affects default OpenFeature deployments with the evaluation endpoint exposed. |
| Impact | The CVSS 7.5 score reflects high real-world risk for publicly accessible Grafana instances. The attack vector is network-based with low complexity and requires no authentication (AV:N/AC:L/PR:N/UI:N), making exploitation trivial for any attacker who can reach the endpoint. The vulnerability is automatable and can cause complete service disruption (A:H), impacting monitoring and observability infrastructure that organizations depend on for operational visibility. While EPSS probability data is not provided and no public exploit has been identified, the technical simplicity of memory exhaustion attacks and the lack of authentication barriers suggest this vulnerability could be easily weaponized. Organizations running internet-facing Grafana deployments should treat this as a high-priority remediation, as denial-of-service against monitoring infrastructure can mask concurrent security incidents or operational failures. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends HTTP requests to the Grafana OpenFeature evaluation endpoint with extremely large feature toggle values designed to exceed available memory. Because the endpoint processes these values without size validation, repeated requests rapidly consume server memory until the Grafana process crashes or the host exhausts RAM, causing complete denial of service for all monitoring dashboards and alerting functionality dependent on the instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Grafana's OpenFeature feature toggle evaluation endpoint can be forced into an out-of-memory condition by submitting unbounded values, enabling remote denial-of-service attacks against the monitoring platform. The vulnerability is network-accessible, requires no authentication (CVSS AV:N/AC:L/PR:N), and has been assigned a CVSS score of 7.5 with high availability impact. No public exploit identified at time of analysis, and authentication requirements confirm unauthenticated access per the CVSS vector PR:N.
RemediationAI
Consult the official Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-27880 for patch details and specific upgrade instructions, as the exact fixed version is not specified in available intelligence sources. Until patching is complete, implement network-level access controls to restrict exposure of the OpenFeature evaluation endpoint to trusted IP ranges only, preferably limiting access to internal networks. Deploy rate limiting and request size restrictions at the reverse proxy or web application firewall layer to mitigate unbounded memory allocation attempts. Monitor Grafana instances for abnormal memory consumption patterns and configure restart policies to maintain service availability during potential exploitation attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects Grafana's implementation of OpenFeature, an open specification for feature flag management that enables dynamic configuration changes without redeployment. The affected component is the feature toggle evaluation endpoint, which processes feature flag evaluation requests. According to the CPE identifier cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*, the vulnerability resides in Grafana's core application. The root cause is unbounded memory allocation when processing input values during feature toggle evaluation, allowing attackers to exhaust available memory resources by submitting specially crafted evaluation requests with oversized payloads. While no specific CWE classification is provided, this represents a classic resource exhaustion vulnerability pattern common in services that fail to impose limits on user-controlled input size.
Know when Grafana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
Lifecycle Timeline
2DescriptionCVE.org
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
Executive ViewAI
Grafana deployments are vulnerable to unauthenticated remote denial-of-service attacks through the OpenFeature toggle evaluation endpoint, which can be exhausted by unbounded input values, causing service outages and loss of monitoring visibility across infrastructure. Organizations relying on Grafana for critical observability face immediate risk of monitoring blackouts without authentication barriers to exploit.
Disable the OpenFeature feature toggle evaluation endpoint if not required for operations. Implement network segmentation to restrict endpoint access to trusted internal sources only. Deploy WAF rules with strict rate limiting and input validation on the OpenFeature endpoint. Monitor for abnormal request patterns indicating exploitation attempts. Maintain current backups of Grafana configuration and enable alerting on service availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
GitHub PoC
Exploit-DB