CVE-2026-28376: Grafana Live push endpoint allows unbounded memory allocation leading to OOM
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Grafana Live push endpoint if it is not required to prevent unbounded memory allocation from large or streaming request bodies.
Grafana Live push endpoint enabled = false - Compensating control
Restrict access to the Grafana Live API to trusted IPs and administrative users at the network/firewall level so only authorized entities can reach the endpoint.
- Compensating control
Enforce request body size limits and rate limiting for the Grafana Live endpoint via a reverse proxy, WAF, or load balancer to prevent large or streaming requests from causing unbounded memory allocation.
- Operational
Monitor Grafana memory usage and logs for unusually large or streaming requests to the Live push endpoint; if an out-of-memory condition occurs, restart the Grafana service, investigate logs to identify the source, and block or disable offending accounts/IPs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28376?
CVE-2026-28376 has a high severity due to its potential to lead to out-of-memory conditions.
How does CVE-2026-28376 affect Grafana users?
CVE-2026-28376 affects authenticated users who can exploit the push endpoint with large or streaming requests.
How can I fix CVE-2026-28376?
To fix CVE-2026-28376, upgrade to the latest patched version of Grafana that resolves the memory allocation issue.
What versions of Grafana are affected by CVE-2026-28376?
CVE-2026-28376 affects Grafana versions from 11.6.0 up to 12.4.3, as well as specific 13.x versions.
Is there a workaround for CVE-2026-28376?
Currently, the recommended action for CVE-2026-28376 is to upgrade to a non-vulnerable version rather than relying on a workaround.