CVE-2021-28148: grafana
Vulnerability summary
CVE-2021-28148 is a high (CVSS 7.5) vulnerability in grafana. EPSS estimates a 3.50% chance of exploitation in the next 30 days, higher than 89.1% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 8Timeline
- 22-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.50%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.50% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- grafana≥ 6.0.0, < 7.4.5-r0
Grafana1 product
- grafana≥ 6.0.0, < 6.7.6 | ≥ 7.0.0, < 7.3.10 | ≥ 7.4.0, < 7.4.5
2 vendors · 2 products
References
9 links- community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724X Refsource MISCVendor Advisory
- grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/X Refsource MISCRelease NotesVendor Advisory
- grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/X Refsource MISCRelease NotesVendor Advisory