The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

  - A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by     sending concurrent requests that cause a fatal map access error. This results in complete service     unavailability requiring restart of the Grafana server. (CVE-2026-28379)

  - A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the     entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory     condition, potentially causing a denial of service. (CVE-2026-28383)

  - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - Public dashboards with annotations enabled did not limit their annotation timerange to the locked     timerange of the public dashboard. This means one could read the entire history of annotations visible on     the specific dashboard, even those outside the locked timerange. This did not leak any annotations that     would not otherwise be visible on the public dashboard. (CVE-2026-21722)

  - A resample query can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-27879)

  - A testdata data-source can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-28375)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - Public dashboards with annotations enabled did not limit their annotation timerange to the locked     timerange of the public dashboard. This means one could read the entire history of annotations visible on     the specific dashboard, even those outside the locked timerange. This did not leak any annotations that     would not otherwise be visible on the public dashboard. (CVE-2026-21722)

  - A resample query can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-27879)

  - A testdata data-source can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-28375)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3718-1 advisory.

    grafana updated from version 11.6.14+security04 to version 12.4.5:

    Security fixes:

    - CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
    - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints     (bsc#1271331)
    - CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
    - CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

    Breaking chahnges introduced in version 12.0.0:

    - BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.
    - BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
    - BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect     UIDs.


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20940-1 advisory.

    Changes in grafana:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by       updating golang.org/x/net to version 0.55.0 (bsc#1266600)

    - Update to version 11.6.14+security-04:
      Security:
      * CVE-2026-28374: Fix insecure direct object reference in         Annotations API (bsc#1265290)
      * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live         push endpoint (bsc#1265289)
      * CVE-2026-28383: Fix unbounded memory allocation in Grafana         plugin resources (bsc#1265286)
      * CVE-2026-28380: Fix broken access control in Snapshot API         (bsc#1265287)
      * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass         (bsc#1265285)
      * CVE-2026-28379: Fix viewer-triggered race condition in         Grafana Live (bsc#1265288)
      * CVE-2026-33377: Fix dashboard Editor Privilege Escalation         (bsc#1265284)
      * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin         (bsc#1265283)
      * CVE-2026-33381: Prevent users from generating Service Account         tokens after permissions removal (bsc#1265281)
      * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing         an authenticated attacker to read arbitrary files from the         Grafana servers filesystem (bsc#1265282)

    - CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
    - CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability       in Apache Thrift (bsc#1263501)

    - CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1       (bsc#1258595)
    - CVE-2026-21725: Fix missing UID when deleting datasource by name       (bsc#1258873)

    - Update to version 11.6.14+security-01:
      Security:
      * CVE-2026-33375: Fix denial of Service via out-of-memory         exhaustion in MSSQL data source plugin (bsc#1260881)

    - Update to version 11.6.14:
      Security:
      * CVE-2026-27876: Fix remote arbitrary code execution via chained         SQL Expressions (bsc#1261025)
      * CVE-2026-27877: Fix information disclosure of data-source         passwords via public dashboards (bsc#1261026)
      * CVE-2026-28375: Fix denial of service via testdata data-source         (bsc#1261029)
      * CVE-2026-27879: Fix denial of service via resample query         (bsc#1261027)
      * CVE-2026-33186: Fix authorization bypass due to improper         validation of the HTTP/2 :path pseudo-header (bsc#1260263)
      * CVE-2026-21724: Fix authorization bypass allows modification of         protected webhook URLs (bsc#1260878)

    - Update to version 11.6.13:
      Enhancement:
      * Wire the public dashboard service to the HTTP server

    - Update to version 11.6.12:
      Enhancement:
      * Update authentication redirect logic       Bug fix:
      * Fix single panel render with variable references

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:
  - A broken access control flaw in the Snapshot API allows any Editor to delete dashboard snapshots, even     those they have no read or write access to. (CVE-2026-28380)

  - When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses, allowing the     intended whitelist to be bypassed. (CVE-2026-33376)

  - Dashboard import overwrites the dashboard ACL, allowing an Editor to overwrite a dashboard not owned by     them and acquire admin on that specific dashboard. (CVE-2026-33377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
360003	AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)	Nessus	Alma Linux Local Security Checks	Local	medium
353161	Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)	Nessus	Rocky Linux Local Security Checks	Local	high
352462	AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)	Nessus	Alma Linux Local Security Checks	Local	high
339730	SUSE SLES15 Security Update : grafana (SUSE-SU-2026:3718-1)	Nessus	SuSE Local Security Checks	Local	medium
321072	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)	Nessus	SuSE Local Security Checks	Local	medium
316482	Grafana Labs < 11.6.14+security-04 / 12.2.0 < 12.2.8+security-04 / 12.3.0 < 12.3.6+security-04 / 12.4.0 < 12.4.3+security-02 / 13.0.0 < 13.0.1+security-01 Multiple Vulnerabilities	Nessus	Web Servers	Remote	high
316384	Linux Distros Unpatched Vulnerability : CVE-2026-28376	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-28376

medium

Tenable Plugins

medium

high

high

medium

medium

high

medium