EUVD-2026-42921Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Grafana HTTP endpoint over network
-
DeliverySend crafted resource-heavy request
-
ExploitTrigger uncontrolled resource consumption
-
ExecutionExhaust CPU/memory/connections
-
ImpactService becomes unavailable (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker requires network reachability to the Grafana HTTP service, and per the supplied CVSS vector no privileges (PR:N) or user interaction (UI:N) are needed against affected versions (Grafana OSS 11.6.0-11.6.14, 12.2.0-12.2.8, 12.3.0-12.3.6, 12.4.0-12.4.3, 13.0.0-13.0.1). Limiting factors: the advisory does not identify the specific vulnerable endpoint or confirm it is truly pre-authentication, so if the affected path sits behind Grafana login the practical bar rises to an authenticated user; impact is availability-only (no data compromise), and instances not exposed beyond a trusted network are substantially harder to reach. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, no-privilege, no-interaction attack yielding high availability impact - a strong theoretical DoS signal. However, EPSS is only 0.36% (28th percentile), it is NOT listed in CISA KEV, and no POC is referenced, so real-world exploitation pressure is currently low. Note a tension worth verifying: Grafana endpoints frequently require authentication, yet the supplied vector claims PR:N (unauthenticated); the advisory does not name the specific endpoint or whether it is pre-auth, so the true privilege requirement is unconfirmed from available data. No SSVC decision data was provided. Net: a legitimate availability bug that warrants routine patching, but not an emergency given absent exploitation evidence and impact limited to availability. |
| Exploit ScenarioDerived | An attacker who can reach the Grafana web service sends specially crafted or high-cost requests that trigger the uncontrolled resource consumption, driving CPU or memory usage until the instance becomes unresponsive and dashboards/alerting go dark. Because the CVSS vector rates attack complexity low and no user interaction, a single automated client could sustain the condition; no public exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 13, 2026
Denial of service in Grafana OSS (multiple 11.6.x, 12.2.x, 12.3.x, 12.4.x and 13.0.x branches) lets remote attackers exhaust server resources and crash or hang the analytics dashboard, per an Alpine Linux advisory that ships the fix in package build 12.4.4-r0. The flaw is an uncontrolled-resource-consumption (CWE-400) condition scored CVSS 7.5 with availability-only impact; no confidentiality or integrity loss occurs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.36%, 28th percentile).
Earlier versions of this analysis (2)
Denial of service in Grafana OSS (branches 11.6.x, 12.2.x, 12.3.x, 12.4.x, and 13.0.x) lets a remote unauthenticated attacker exhaust server resources and crash or hang the instance, per CWE-400 (Uncontrolled Resource Consumption). The flaw carries availability-only impact (CVSS 7.5, A:H) with no confidentiality or integrity effect, and no public exploit is identified at time of analysis. EPSS is low at 0.36% (28th percentile), consistent with a real but not yet mass-exploited resource-exhaustion issue.
Grafana received a security fix packaged as version 12.4.4-r0 in Alpine Linux. The nature of the underlying vulnerability is not disclosed in the available intelligence - no CVE description, CWE classification, CVSS vector, or vendor advisory has been provided. The fix is confirmed only through Alpine Linux's package repository reporting. Security teams running Grafana on Alpine Linux should treat the 12.4.4-r0 package as the minimum safe version pending disclosure of full vulnerability details.
RemediationAI
Upgrade Grafana to a fixed release beyond the affected ranges - on Alpine Linux, update the grafana package to 12.4.4-r0 or later (Vendor-released patch: 12.4.4-r0); for upstream Grafana OSS, move to the first patched build above your branch's affected upper bound (e.g. 12.4.4, and the corresponding fixed releases for the 11.6.x, 12.2.x, 12.3.x and 13.0.x lines) as documented in the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-8609. If immediate patching is not possible, reduce exposure by restricting network access to the Grafana HTTP endpoint so it is reachable only from trusted networks or behind a VPN/reverse proxy, and place a rate-limiting/WAF layer in front to cap request volume to the vulnerable path - trade-off is added latency and possible blocking of legitimate high-frequency dashboard/API clients. Avoid exposing Grafana directly to the internet until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grafana is a widely deployed open-source observability and dashboarding platform (Go-based HTTP server) used to visualize metrics, logs and traces. The affected package is identified by CPE cpe:2.3:a:grafana:grafana across all listed builds. The root cause is CWE-400 (Uncontrolled Resource Consumption): a code path allows an attacker-controlled request to consume disproportionate CPU, memory, or connection/goroutine resources without an enforced bound, degrading or halting the service. The advisory and tags classify it explicitly as a Denial of Service issue rather than a code-execution or data-exposure bug, consistent with the C:N/I:N/A:H CVSS impact.
Know when Grafana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable low-complexity resource-exhaustion with availability-only impact; PR:N retained from source vector though the specific endpoint's auth requirement is unverified.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Alpine Linux: grafana fixed in 12.4.4-r0
Executive ViewAI
Grafana OSS (versions 11.6-13.0) contains a denial-of-service vulnerability (CVE-2026-8609) that allows remote attackers to exhaust server resources and crash or hang the analytics dashboard, disrupting operational monitoring and incident response capabilities. Exploitation risk remains low with no public exploit identified at time of analysis.
Alpine Linux patch available in build 12.4.4-r0. For other distributions, upstream vendor patch status pending. Interim mitigations: implement connection rate-limiting at reverse proxy, configure CPU and memory resource limits for Grafana process, restrict network access to Grafana to known trusted sources, establish monitoring alerts for anomalous resource consumption, and maintain configuration backups for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
GitHub PoC
Exploit-DB