CVE-2026-28379
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error.
Published May 13, 2026 · updated Jun 17, 2026 · grafana grafana
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
Jun 17, 2026 · NIST NVD
Updated
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
Affected
- cpe grafana/grafanaversion unspecified
- cpe grafana/grafana11.6.14
- cpe grafana/grafana12.2.8
Sources
- CVE.orgVulnerability recordCVE-2026-28379
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28379
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
nvd.nist.gov