What is CVE-2026-28376?

CVE-2026-28376 is a security advisory published by Grafana Labs Security. Grafana Live push endpoint allows unbounded memory allocation leading to OOM

Why does CVE-2026-28376 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-28376?

CVE-2026-28376 affects 1 product, including: Grafana.

CVE-2026-28376Disclosed before NVD

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

Vendor

Grafana Labs Security

Published

May 13, 2026

Last Modified

—

📋 Description

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-28376/