Grafana EUVD-2026-42920

Exploitation requires network reachability to a running Grafana instance (default HTTP service on TCP 3000) and no authentication or user interaction, consistent with AV:N/AC:L/PR:N/UI:N. The specific triggering feature or endpoint is not detailed in the provided description beyond the CWE-400 resource-exhaustion class, so the exact vulnerable request cannot be named from available data - verify against the Grafana advisory. Practical exploitation is limited to reachable instances: Grafana deployments that are not internet-exposed, sit behind an authenticating proxy, or are firewalled to management-only networks are substantially harder to attack despite the unauthenticated CVSS profile.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 High) indicates a straightforward network-based, unauthenticated attack requiring no user interaction, with impact confined entirely to availability - no confidentiality or integrity loss. This is a pure denial-of-service issue, consistent with the CWE-400 classification and the 'Denial Of Service' tag. No EPSS score, KEV listing, or POC signal was supplied in the input, so real-world exploitation pressure cannot be quantified from the available data; treat the 7.5 as an upper-bound severity for an availability-only flaw rather than evidence of active targeting. For internet-exposed Grafana instances the low attack complexity makes this a legitimate patch priority, whereas instances behind authentication proxies or restricted networks face materially lower practical risk.

An attacker who can reach a Grafana instance over the network sends crafted requests that trigger the uncontrolled resource consumption path, driving memory or CPU usage until the service becomes unresponsive and dashboards/alerting go dark. Because no authentication or user interaction is required, an internet-exposed instance can be knocked offline by a single low-privilege remote actor. No public POC is identified at time of analysis.