Grafana 8.1.0 < 11.6.14 / 12.0.0 < 12.1.10 / 12.2.0 < 12.2.8 /...

CVE-2026-28375 is an uncontrolled resource consumption flaw (CWE-400 / CWE-770) in Grafana's built-in TestData datasource, a core plugin that ships enabled in every Grafana installation since version 8.1.0. Any authenticated user — even one with the lowest Viewer role — can craft a query against the testdata datasource that triggers unbounded memory allocations, causing the Grafana server process to hit an OOM condition and crash. Affected version ranges are massive: 8.1.0 through 11.6.13, 12.0.0 through 12.1.9, 12.2.0 through 12.2.7, 12.3.0 through 12.3.5, and 12.4.0 through 12.4.1. Fixed in 11.6.14, 12.1.10, 12.2.8, 12.3.6, and 12.4.2.

Grafana's own MEDIUM / 6.5 rating is directionally correct but generous at the score level. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H mechanically scores the availability impact as High, but ignores that Grafana processes typically restart within seconds under systemd or container orchestration, making the crash self-healing in most production deployments. There is no confidentiality or integrity impact whatsoever — no data leaks, no code execution, no lateral movement. Tenable's own VPR of 3.0 (Low, 24th percentile) reflects this reality. The EPSS probability is 0.38%, there are no public PoCs, no KEV listing, and zero observed in-the-wild exploitation. We hold the MEDIUM band but compress the score to 5.0 to reflect practical recoverability and the authentication gate.

1. Set memory limits on the Grafana process — Configure cgroup memory limits (systemd MemoryMax= or Kubernetes resources.limits.memory) to cap Grafana at a sane ceiling (e.g., 2–4 GB). This ensures the OOM kill is fast, contained, and doesn't starve co-located services. Deploy within the 365-day noisgate remediation window alongside the patch, or sooner if you have exposed instances.
2. Restrict testdata datasource access via RBAC — In Grafana Enterprise, use RBAC to deny query permissions on the grafana-testdata-datasource for all roles except Admins. In OSS Grafana, remove or disable the testdata datasource instance if it's not needed — most production deployments don't use it. This eliminates the attack surface entirely.
3. Enable query timeouts and rate limiting — Set dataproxy.timeout and query concurrency limits in grafana.ini to bound runaway queries. Pair with a reverse proxy (nginx, Envoy) that enforces per-user request rate limits on /api/ds/query. This makes sustained DoS via repeated crashes impractical.
4. Ensure automatic restart is configured — Verify Grafana runs under a supervisor that restarts on crash — Restart=always in the systemd unit, or restartPolicy: Always in Kubernetes. This is standard but worth confirming. Recovery time should be <10 seconds.
5. Deploy Grafana in HA mode — Run multiple Grafana replicas behind a load balancer. A single-node OOM crash doesn't take down the service. This is a best practice for production observability stacks regardless of this CVE.

Run this script on the Grafana host (or any host that can reach the Grafana API) as any user. It queries the Grafana health and build-info endpoints — no authentication required for version detection. Usage: bash check_cve_2026_28375.sh https://grafana.internal:3000

#!/usr/bin/env bash
# check_cve_2026_28375.sh — Detect CVE-2026-28375 (Grafana testdata OOM DoS)
# Usage: bash check_cve_2026_28375.sh <GRAFANA_URL>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:?Usage: $0 <GRAFANA_URL>}"
GRAFANA_URL="${GRAFANA_URL%/}"

# Fetch version from build info endpoint (unauthenticated)
RESPONSE=$(curl -sf --max-time 10 "${GRAFANA_URL}/api/health" 2>/dev/null || true)

if [[ -z "$RESPONSE" ]]; then
  echo "UNKNOWN — could not reach ${GRAFANA_URL}/api/health"
  exit 2
fi

VERSION=$(echo "$RESPONSE" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)

if [[ -z "$VERSION" ]]; then
  # Try /api/frontend/settings as fallback
  RESPONSE2=$(curl -sf --max-time 10 "${GRAFANA_URL}/api/frontend/settings" 2>/dev/null || true)
  VERSION=$(echo "$RESPONSE2" | grep -oP '"buildInfo".*?"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not extract Grafana version from ${GRAFANA_URL}"
  exit 2
fi

echo "Detected Grafana version: ${VERSION}"

# Parse version components
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Version comparison logic
# Vulnerable ranges:
#   8.1.0 <= v < 11.6.14
#   12.0.0 <= v < 12.1.10
#   12.2.0 <= v < 12.2.8
#   12.3.0 <= v < 12.3.6
#   12.4.0 <= v < 12.4.2

VULNERABLE=false

if (( MAJOR >= 8 && MAJOR <= 11 )); then
  if (( MAJOR == 8 && MINOR == 0 )); then
    VULNERABLE=false  # 8.0.x not affected (starts at 8.1.0)
  elif (( MAJOR == 11 && MINOR == 6 && PATCH >= 14 )); then
    VULNERABLE=false  # 11.6.14+ is patched
  elif (( MAJOR == 8 )) && (( MINOR >= 1 )); then
    VULNERABLE=true
  elif (( MAJOR >= 9 && MAJOR <= 10 )); then
    VULNERABLE=true
  elif (( MAJOR == 11 )); then
    if (( MINOR < 6 )); then
      VULNERABLE=true
    elif (( MINOR == 6 && PATCH < 14 )); then
      VULNERABLE=true
    fi
  fi
elif (( MAJOR == 12 )); then
  if (( MINOR == 0 )); then
    VULNERABLE=true  # 12.0.x has no fix in the 12.0 branch
  elif (( MINOR == 1 )); then
    if (( PATCH < 10 )); then
      VULNERABLE=true
    fi
  elif (( MINOR == 2 )); then
    if (( PATCH < 8 )); then
      VULNERABLE=true
    fi
  elif (( MINOR == 3 )); then
    if (( PATCH < 6 )); then
      VULNERABLE=true
    fi
  elif (( MINOR == 4 )); then
    if (( PATCH < 2 )); then
      VULNERABLE=true
    fi
  fi
fi

if $VULNERABLE; then
  echo "VULNERABLE — Grafana ${VERSION} is affected by CVE-2026-28375"
  echo "Upgrade to 11.6.14, 12.1.10, 12.2.8, 12.3.6, or 12.4.2+"
  exit 1
else
  echo "PATCHED — Grafana ${VERSION} is not affected by CVE-2026-28375"
  exit 0
fi

1. Grafana Security Advisory — CVE-2026-28375
2. Tenable Plugin 304689
3. NVD — CVE-2026-28375
4. OpenCVE — CVE-2026-28375
5. SentinelOne Vulnerability Database — CVE-2026-28375
6. Grafana TestData Datasource Documentation
7. Ubuntu Security — CVE-2026-28375
8. OSV — BIT-grafana-2026-28375