PT-2026-28372 · Grafana+1 · Grafana+1

Osidb Bzimport · Publicado 2026-03-27 · Atualizado 2026-06-05 · CVE-2026-27880

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Grafana versions (affected versions not specified)

Description The OpenFeature feature toggle evaluation endpoint has a flaw where it reads input data without limits, potentially leading to out-of-memory crashes. The issue involves reading unbounded values into memory. The vulnerable component is the evaluation API. The API endpoint involved is the feature toggle evaluation endpoint. The input data is read into memory without any bounds checking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Out of bounds Read

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-787

CWE-125

CWE-770

Identificadores relacionados

BDU:2026-08993

BIT-GRAFANA-2026-27880

CVE-2026-27880

Produtos afetados

Grafana

Red Os

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27880.json · Exploit
• https://ubuntu.com/security/CVE-2026-27880 · Aviso do Fabricante
• https://grafana.com/security/security-advisories/cve-2026-27880 · Aviso do Fabricante
• https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-27880 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27880 · Nota de Segurança
• https://twitter.com/CCBalert/status/2038696030955344143 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-27880 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27880 · Aviso do Fabricante
• https://twitter.com/ptdbugs/status/2037547084606230868 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2026-27880 · Nota
• https://osv.dev/vulnerability/BIT-grafana-2026-27880 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2026-27880 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-grafana-cve-2026-27880-7.3 · Nota
• https://github.com/advisories/GHSA-jmfj-8gxc-cg8c · Nota
• https://twitter.com/autumn_good_35/status/2037538533616021586 · Publicação no Twitter