CVE-2026-28376 - Vulnerability Details - OpenCVE

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Grafana	Grafana

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/mdr-for-endpoint
https://grafana.com/security/security-advisories/cve-2026-28376

History

Thu, 14 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 14 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Grafana Grafana grafana
Vendors & Products		Grafana Grafana grafana

Wed, 13 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
Title		Grafana Live push endpoint allows unbounded memory allocation leading to OOM
References		https://grafana.com/security/security-advisories/cve-2026-28376
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2026-05-13T19:28:26.544Z

Updated: 2026-05-14T18:10:54.005Z

Reserved: 2026-02-27T07:16:12.218Z

Link: CVE-2026-28376

Vulnrichment

Updated: 2026-05-14T18:10:47.007Z

NVD

Status : Undergoing Analysis

Published: 2026-05-13T20:16:19.760

Modified: 2026-05-14T19:16:31.730

Link: CVE-2026-28376

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28376", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-02-27T07:16:12.218Z", "datePublished": "2026-05-13T19:28:26.544Z", "dateUpdated": "2026-05-14T18:10:54.005Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["OnPrem"], "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.14", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "11.6.14+security-04", "status": "affected", "version": "11.6.14", "versionType": "custom"}, {"lessThanOrEqual": "12.2.8", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "12.2.8+security-04", "status": "affected", "version": "12.2.8", "versionType": "custom"}, {"lessThanOrEqual": "12.3.6", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.3.6+security-04", "status": "affected", "version": "12.3.6", "versionType": "custom"}, {"lessThanOrEqual": "12.4.3", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "12.4.3+security-02", "status": "affected", "version": "12.4.3", "versionType": "custom"}, {"lessThanOrEqual": "13.0.1", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.0.1+security-01", "status": "affected", "version": "13.0.1", "versionType": "custom"}]}], "datePublic": "2026-05-13T07:44:00.000Z", "descriptions": [{"lang": "en", "value": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue."}], "metrics": [{"cvssV3_1": {"baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-05-13T19:35:07.723Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-28376"}], "source": {"discovery": "INTERNAL"}, "title": "Grafana Live push endpoint allows unbounded memory allocation leading to OOM"}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T18:10:50.762919Z", "id": "CVE-2026-28376", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T18:10:54.005Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28376", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T18:10:50.762919Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T18:10:47.007Z"}}], "cna": {"title": "Grafana Live push endpoint allows unbounded memory allocation leading to OOM", "source": {"discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "11.6.14", "lessThan": "11.6.14+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.2.8", "lessThan": "12.2.8+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.3.6", "lessThan": "12.3.6+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "12.4.3", "lessThan": "12.4.3+security-02", "versionType": "custom"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}, {"status": "affected", "version": "13.0.1", "lessThan": "13.0.1+security-01", "versionType": "custom"}], "platforms": ["OnPrem"], "defaultStatus": "unaffected"}], "datePublic": "2026-05-13T07:44:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-28376", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-05-13T19:35:07.723Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28376", "state": "PUBLISHED", "dateUpdated": "2026-05-14T18:10:54.005Z", "dateReserved": "2026-02-27T07:16:12.218Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-05-13T19:28:26.544Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}