Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-28379

Viewer-triggered race condition in Grafana Live leads to complete server crash

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 8.2.0 to ≤ 11.6.14affected
  • 11.6.14 to < 11.6.14+security-04affected
  • 12.0.0 to ≤ 12.2.8affected
  • 12.2.8 to < 12.2.8+security-04affected
  • 12.3.0 to ≤ 12.3.6affected
  • 12.3.6 to < 12.3.6+security-04affected
  • 12.4.0 to ≤ 12.4.3affected
  • 12.4.3 to < 12.4.3+security-02affected
  • 13.0.0 to ≤ 13.0.1affected
  • 13.0.1 to < 13.0.1+security-01affected

References