Executive brief
A vulnerability in Grafana Live, a feature used for real-time data streaming, allows users with basic 'Viewer' permissions to crash the entire Grafana server. By sending specific simultaneous requests, an attacker can cause a fatal error that makes the service completely unavailable to all users. Restoring operations requires a manual restart of the server by administrators.
Technical details
A race condition (CWE-362) exists within the Grafana Live component due to improper synchronization during shared resource access. Authenticated attackers with at least 'Viewer' privileges can exploit this by sending concurrent network requests that trigger a fatal map access error (concurrent map read/write panic). Successful exploitation results in a complete denial-of-service (DoS) as the Go runtime terminates the process, necessitating a manual service restart. Patches are available in versions 11.6.14, 12.2.8, 12.3.6, 12.4.3, and 13.0.1 (and their respective security releases).
Affected products
- Grafana Labs Grafana 8.5.0 to 11.6.13, 12.2.0 to 12.2.7, 12.3.0 to 12.3.5, 12.4.0 to 12.4.2, 13.0.0
Timeline
- 2026-05-13: advisory: Initial advisory published by Grafana Labs
- 2026-05-13: disclosed
- 2026-06-02: other: NIST analysis and CPE information added