Grafana EUVD-2026-16636

This vulnerability presents a moderate real-world risk despite its 6.5 CVSS score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network accessibility with low attack complexity but requires authenticated login (PR:L), which restricts the attacker pool to legitimate users or accounts obtained through credential compromise. The impact is limited to availability (A:H) with no confidentiality or integrity breach, making it a denial-of-service rather than data exfiltration risk. The absence of any public exploit code or CISA KEV confirmation suggests this has not yet been actively exploited in production environments, reducing immediate urgency. However, Grafana's critical role in observability stacks means that denial-of-service can have cascading effects on incident response capabilities. Organizations should prioritize patching based on their tolerance for monitoring downtime and the sensitivity of authenticated user access controls. For environments with open Grafana access or weak authentication, risk elevation is warranted.

An authenticated Grafana user with query execution permissions crafts a resample query containing parameters designed to force allocation of extremely large in-memory buffers (for example, requesting resampling of a massive time range into microsecond granularity with high cardinality dimensions). When submitted to the Grafana backend, the query processor begins buffering the entire result set in memory without bounds, quickly exhausting available heap space. The Java or Go process (depending on Grafana version) crashes with an out-of-memory error, rendering the monitoring dashboard inaccessible until manual restart. This scenario requires valid authentication but no special privileges, and the attack is trivial to execute once query syntax is reverse-engineered, though no public exploit code is currently documented.