CVE-2026-28376 MEDIUM

CVE-2026-28376: Grafana Live push endpoint allows unbounded memory allocation leading to OOM

Vendor Grafana
Product Grafana OSS
Published May 13, 2026
Last update June 12, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

Key dates

02Disclosure timeline

May 13, 2026 CVE published
June 12, 2026 Record updated