CVE-2026-28375 A testdata data-source can be used to trigger out-of-memory crashes in Grafana

Description

A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

Affected products and versions

Product	Affected versions	Fixed in
grafana 12.4	12.4.0 → < 12.4.2	12.4.2
grafana 12.3	12.3.0 → < 12.3.6	12.3.6
grafana 12.2	12.2.0 → < 12.2.8	12.2.8
grafana 12.0	12.0.0 → < 12.1.10	12.1.10
grafana 8.1	8.1.0 → < 11.6.14	11.6.14

Other CVEs of grafana

The 59 CVEs of grafana →

CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana 6.5 Medium CVE-2026-27876 RCE on Grafana via sqlExpressions 9.1 Critical CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory… 7.5 High CVE-2026-27877 When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being… 6.5 Medium