CVE-2026-28375: 
Grafana vulnerability analysis and mitigation

CVE-2026-28375 is an uncontrolled resource consumption vulnerability in Grafana that allows an authenticated attacker with low privileges to trigger out-of-memory (OOM) crashes via the testdata data-source. It was published on March 27, 2026, and affects a wide range of Grafana versions: all versions before 8.1.0, versions 8.1.0 through 11.6.13, 12.0.0 through 12.1.9, 12.2.0 through 12.2.7, 12.3.0 through 12.3.5, and 12.4.0 through 12.4.1. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/High) (Grafana Advisory, EUVD).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). An authenticated attacker with low-privilege network access can craft requests using Grafana's built-in testdata data-source in a way that causes unbounded memory allocation, ultimately exhausting available memory and crashing the Grafana process. No user interaction is required, and the attack complexity is low. No public proof-of-concept exploit code has been identified at this time (Grafana Advisory, EUVD).

Successful exploitation results in a denial-of-service condition, rendering the Grafana instance unavailable to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact. Organizations relying on Grafana for monitoring and observability dashboards could experience significant operational disruption, particularly in environments where Grafana is a critical component of infrastructure visibility (Grafana Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 304097, 304689) and Qualys (762953, 762951) (Grafana Advisory, Tenable).

• Logs: Grafana application logs showing repeated OOM errors or unexpected process restarts; log entries referencing testdata data-source queries with abnormally large or unusual parameters.
• Process/System: Sudden spikes in Grafana process memory consumption visible via system monitoring tools (e.g., top, htop, Prometheus node exporter); Grafana service restart events triggered by the OS OOM killer.
• Network: Unusual or high-frequency API requests to Grafana endpoints associated with testdata data-source configuration or query execution from low-privilege accounts.

Grafana has released patched versions addressing this vulnerability. Users should upgrade to one of the following fixed releases: 8.1.0 (for versions before 8.1.0), 11.6.14 (for versions 11.6.0–11.6.13), 12.1.10 (for versions 12.1.0–12.1.9), 12.2.8 (for versions 12.2.0–12.2.7), 12.3.6 (for versions 12.3.0–12.3.5), or 12.4.0 or later. As a workaround, administrators should implement network access controls to restrict testdata data-source usage to authorized personnel only, and monitor Grafana instances for unexpected memory consumption or restart events (Grafana Advisory, SUSE Advisory).

SUSE issued security update announcements (SUSE-SU-2026:2258-1 and SUSE-SU-2026:2265-1) addressing this vulnerability in their Grafana packages, indicating downstream Linux distribution vendors are actively patching (SUSE Advisory). The FreeBSD VuXML database also recorded the vulnerability, and Tenable released Nessus detection plugins shortly after disclosure. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking activity.