PT-2026-28372 · Grafana · Grafana

Published 2026-03-27 · Updated 2026-04-01 · CVE-2026-27880

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Grafana versions (affected versions not specified)

Description The OpenFeature feature toggle evaluation endpoint has a flaw where it reads input data without limits, potentially leading to out-of-memory crashes. The issue involves reading unbounded values into memory. The vulnerable component is the evaluation API. The API endpoint involved is the feature toggle evaluation endpoint. The input data is read into memory without any bounds checking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BIT-GRAFANA-2026-27880

CVE-2026-27880

Affected Products

Grafana

References · 10

• https://cve.org/CVERecord?id=CVE-2026-27880 · Security Note
• https://ubuntu.com/security/CVE-2026-27880 · Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2026-27880 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27880 · Security Note
• https://osv.dev/vulnerability/BIT-grafana-2026-27880 · Vendor Advisory
• https://twitter.com/ptdbugs/status/2037547084606230868 · Twitter Post
• https://twitter.com/CCBalert/status/2038696030955344143 · Twitter Post
• https://twitter.com/autumn_good_35/status/2037538533616021586 · Twitter Post
• https://twitter.com/KwazaIct/status/2037543841025122800 · Twitter Post