Review reviewHigh

CVE-2026-27880

Grafana Grafana, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.77%

Technical severityCVSS 7.5

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

Product: Grafana Grafana, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8
Affected versions: >= v12.1.0 < v12.1.10, >= v12.2.0 < v12.2.8, >= v12.3.0 < v12.3.6, >= v12.4.0 < v12.4.2, < 12.1.0, >= 12.1.10 < 12.2.0, >= 12.2.8 < 12.3.0, >= 12.3.6 < 12.4.0
Fixed versions: 12.1.0, 12.2.0, 12.3.0, 12.4.0

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Grafana Grafana, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.