{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28375", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-02-27T07:16:12.218Z", "datePublished": "2026-03-27T14:26:19.270Z", "dateUpdated": "2026-03-27T14:28:51.768Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-03-27T14:28:51.768Z"}, "datePublic": "2026-03-27T14:23:47.094Z", "title": "Grafana Testdata datasource can issue unbounded memory allocations", "descriptions": [{"lang": "en", "value": "A testdata data-source can be used to trigger out-of-memory crashes in Grafana."}], "affected": [{"vendor": "Grafana", "product": "Grafana", "platforms": ["OnPrem"], "defaultStatus": "unaffected", "versions": [{"version": "v8.1.0", "status": "affected", "versionType": "semver", "lessThan": "v11.6.14"}, {"version": "v12.0.0", "status": "affected", "versionType": "semver", "lessThan": "v12.1.10"}, {"version": "v12.2.0", "status": "affected", "versionType": "semver", "lessThan": "v12.2.8"}, {"version": "v12.3.0", "status": "affected", "versionType": "semver", "lessThan": "v12.3.6"}, {"version": "v12.4.0", "status": "affected", "versionType": "semver", "lessThan": "v12.4.2"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-28375", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "source": {"discovery": "INTERNAL_FINDING"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A testdata data-source can be used to trigger out-of-memory crashes in Grafana."}], "id": "CVE-2026-28375", "lastModified": "2026-03-30T13:26:29.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@grafana.com", "type": "Secondary"}]}, "published": "2026-03-27T15:16:51.547", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-28375"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "grafana: Grafana: Denial of Service via testdata data-source", "id": "2452279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452279"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Grafana. A remote attacker with low privileges could exploit this vulnerability by using a specially crafted testdata data-source. This could trigger out-of-memory crashes, leading to a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-28375", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-27T14:26:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28375\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28375\nhttps://grafana.com/security/security-advisories/cve-2026-28375"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,11.6.14)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.1.10)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.8)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.6)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "analysis": {"en": {"generated_at": "2026-03-27T15:51:57.361468+00:00", "value": {"mitigation_remediation": ["Update Grafana to the latest version that contains the CVE-2026-28375 fix", "If an immediate update is not feasible, disable or remove the testdata datasource to block exploitation", "Restrict user permissions so that only authorized administrators can create or configure data sources", "Monitor Grafana logs for out\u2011of\u2011memory errors or abnormal memory usage linked to the testdata datasource"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Grafana is the affected vendor and product. All releases that include the default testdata datasource are impacted until a patch or update is applied. Specific version details are not enumerated in the advisory, so any Grafana instance that has the testdata datasource enabled is considered at risk.", "description_and_impact": "A Grafana testdata datasource can be leveraged to trigger out\u2011of\u2011memory conditions, causing the Grafana application to crash or become unresponsive. The vulnerability results from the datasource's unbounded memory allocation capability, which\u2014when invoked\u2014exceeds available system memory and forces the process to terminate. This effectively denies legitimate users the ability to use Grafana until it is restarted, compromising availability and potentially interrupting dashboards, alerts, and user sessions that rely on the service.", "risk_and_exploitability": "The CVSS score of 6.5 denotes a medium severity, reflecting the denial\u2011of\u2011service potential without granting direct access to secrets or data. The exploit probability (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known, widely exploited instances yet. The attack vector is not explicitly detailed; however, it is inferred that an attacker would need the ability to configure or trigger the testdata datasource, which may require authenticated access or public endpoints if exposed. Given the moderate severity and lack of known exploitation, the risk remains noteworthy, especially in environments with high availability requirements."}}}}, "created": "2026-03-27T20:28:31.124969+00:00", "updated": "2026-03-30T07:01:44.499792+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"], "weaknesses": ["CWE-770", "CWE-400"]}