CVE-2026-28379

Published: May 13, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: security@grafana.com (Secondary)

Description

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

Affected (13)

Products: Grafana: Grafana

Grafana

1 product

Grafana

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Grafana Grafana	From 12.2.0 to 12.2.8
Grafana Grafana	From 12.3.0 to 12.3.6
Grafana Grafana	From 12.4.0 to 12.4.3
Grafana Grafana	From 8.5.0 to 11.6.14
Grafana Grafana	Version 11.6.14
Grafana Grafana	Version 11.6.14 security01
Grafana Grafana	Version 12.2.8
Grafana Grafana	Version 12.2.8 security01
Grafana Grafana	Version 12.3.6
Grafana Grafana	Version 12.3.6 security01
Grafana Grafana	Version 12.4.3
Grafana Grafana	Version 13.0.0
Grafana Grafana	Version 13.0.1

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (1)

https://grafana.com/security/security-advisories/cve-2026-28379

Source: security@grafana.com

Vendor Advisory

Timeline

No history available yet.