Grafana EUVD-2026-38309

No special conditions - remote unauthenticated exploitation against default configurations of Grafana, with the only requirement being network reachability to the Grafana HTTP listener (typically TCP/3000) on a version prior to the Alpine-packaged 12.4.4-r0 fix. Limiting factors are minimal per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so the practical constraint is exposure: Grafana instances confined to internal management VLANs or behind authenticating reverse proxies face materially lower realistic risk than internet-exposed deployments.

The CVSS 3.1 base score of 7.5 (High) reflects a network-reachable, low-complexity, unauthenticated attack producing high availability impact with no confidentiality or integrity loss. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied, so exploitation likelihood cannot be quantitatively ranked - defenders should treat any internet-exposed Grafana instance as a meaningful target given Grafana's broad deployment footprint. There is a notable inconsistency in the input data: the 'Information Disclosure' tag conflicts with the CVSS vector (C:N/I:N/A:H), which describes a pure availability impact; this discrepancy should be resolved by consulting the Grafana security advisory before final prioritization.

An attacker who can reach a vulnerable Grafana instance over the network sends a single crafted HTTP request to a pre-authentication endpoint, triggering a condition that exhausts resources or crashes the server process and rendering monitoring dashboards unavailable. Because the CVSS vector requires no privileges and no user interaction, the scenario is repeatable and can be scripted to keep the service down. No public exploit identified at time of analysis.