# CVE-2026-27880: Grafana denial of service in OpenFeature evaluation endpoint

Source: https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-27880 · Severity: high · CVSS 7.5 · Published 2026-03-27

Grafana, a popular data visualization and monitoring platform, is vulnerable to a denial-of-service attack. An attacker can send specially crafted requests to the feature toggle evaluation endpoint, causing the system to consume excessive memory and crash. This can lead to service outages, preventing teams from monitoring their infrastructure and applications.

## Quick answers

**Is CVE-2026-27880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27880 being exploited in the wild.

**How severe is CVE-2026-27880?** High severity, with a CVSS score of 7.5, published 27 March 2026.

**Which products and versions are affected?** Grafana Labs Grafana >=12.1.0, <12.1.10; >=12.2.0, <12.2.8; >=12.3.0, <12.3.6; >=12.4.0, <12.4.2; Red Hat Red Hat Enterprise Linux 9 affected; Red Hat Red Hat Enterprise Linux 10 affected.

**Is there a fix for CVE-2026-27880?** A patch was published on 2026-03-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27880 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-27880?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in Grafana's implementation of the OpenFeature evaluation API. The endpoint responsible for feature toggle evaluation fails to properly bound or throttle the size of input data read into memory (CWE-770). A remote, unauthenticated attacker can exploit this by sending large or malicious payloads, leading to an out-of-memory (OOM) condition and process crash. The vulnerability affects Grafana versions 12.1.x, 12.2.x, 12.3.x, and 12.4.x. Patches have been released in versions 12.1.10, 12.2.8, 12.3.6, and 12.4.2.

## Affected products

- Grafana Labs Grafana >=12.1.0, <12.1.10; >=12.2.0, <12.2.8; >=12.3.0, <12.3.6; >=12.4.0, <12.4.2
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected

## Timeline

- 2026-03-27: disclosed
- 2026-03-30: advisory
- 2026-03-30: patched

## References

- [https://grafana.com/security/security-advisories/cve-2026-27880](https://grafana.com/security/security-advisories/cve-2026-27880)
- [https://access.redhat.com/security/cve/CVE-2026-27880](https://access.redhat.com/security/cve/CVE-2026-27880)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452295](https://bugzilla.redhat.com/show_bug.cgi?id=2452295)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27880.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27880.json)