CVE-2026-27880 OpenFeature evaluation API reads input data with no bounds
Attackers can crash Grafana by sending unbounded data to the OpenFeature evaluation API, causing out-of-memory conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27880?
CVE-2026-27880 is a high-severity denial of service vulnerability in Grafana Grafana, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
Which versions are affected by CVE-2026-27880?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 12.1.0 | 12.1.10, 12.2.8, 12.3.6, 12.4.2 |
Products include Grafana Grafana.
How do I fix CVE-2026-27880?
Upgrade grafana to a fixed version for your release line: 12.1.10, 12.2.8, 12.3.6 or 12.4.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27880 being exploited?
There is no known exploitation of CVE-2026-27880 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-27880, GHSA-jmfj-8gxc-cg8c, MINI-2g29-pvjv-wvx3, MINI-4q3c-5rrp-cw3f, MINI-6p26-wpw8-8v7c, MINI-7625-phqw-mggp and 13 more.