CVE-2026-28379
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
May 13, 2026
CISA due date
—
The record
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | grafana | 0 | 11.6.14+security04-bp160.1.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security04-1.1 |
Related vulnerabilities
- CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects grafana
- CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-42502 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects grafana
- CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Also affects grafana
- CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation… Also affects grafana