CVE-2026-28379: Viewer-triggered race condition in Grafana Live leads to complete server crash
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Grafana Live in the Grafana configuration or via the UI if it is not required to prevent Viewer-role users from triggering the race condition.
Grafana Live enabled = false - Compensating control
Limit assignment of the Viewer role to only trusted users and restrict access to the Grafana instance (for example via firewall rules, VPN, or network ACLs) to reduce exposure to authenticated attackers who could exploit the race condition.
- Operational
If the Grafana server crashes due to this issue, restart the Grafana server to restore service.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28379?
CVE-2026-28379 is classified as a high severity vulnerability due to the potential for a complete server crash.
How do I fix CVE-2026-28379?
To fix CVE-2026-28379, update to the latest version of Grafana Live where the race condition has been addressed.
Who is affected by CVE-2026-28379?
Authenticated users with Viewer role in Grafana Live are affected by CVE-2026-28379.
What type of vulnerability is CVE-2026-28379?
CVE-2026-28379 is a race condition vulnerability that can lead to a server crash.
What causes the vulnerability CVE-2026-28379?
The vulnerability CVE-2026-28379 is caused by concurrent requests sent to the server that result in a fatal map access error.