CVE-2026-28375

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
GrafanaGrafana>= 8.1.0, < 11.6.14; >= 12.0.0, < 12.1.10; >= 12.2.0, < 12.2.8; >= 12.3.0, < 12.3.6; >= 12.4.0, < 12.4.2

References

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-283766.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentialCVE-2026-283777.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing CVE-2026-283782.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dCVE-2026-283796.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cCVE-2026-28384.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ paraCVE-2026-283806.5Any Editor could delete any snapshot, even if they have no access to read or write them.CVE-2026-283818.1The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/wrCVE-2026-283836.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An CVE-2026-283849.9An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commaCVE-2026-283855.0In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authCVE-2026-283867.5Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds CVE-2026-283878.1Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE
CVE-2026-28375: Medium severity, CVSS 6.5 | Vulnix