High severity7.5NVD Advisory· Published Mar 22, 2021· Updated Jun 17, 2026

CVE-2021-28148

Description

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grafana/Grafana2 versions
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*range: >=6.0.0,<6.7.6
- (no CPE)range: 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5
Grafana/Grafana Enterprisedescription
Grafana/Grafana Enterprisellm-fuzzy
Range: 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5
osv-coords51 versions
pkg:bitnami/grafana pkg:rpm/opensuse/ansible&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/ansible&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/dracut-saltboot&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/dracut-saltboot&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/golang-github-prometheus-prometheus&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/mgr-cfg&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/mgr-custom-info&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/mgr-osad&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/mgr-push&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/mgr-virtualization&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/rhnlib&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/spacecmd&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/spacewalk-client-tools&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/spacewalk-koan&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/spacewalk-oscap&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/suseRegisterInfo&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/uyuni-common-libs&distro=openSUSE%20Leap%2015.3 pkg:rpm/suse/ansible&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/dracut-saltboot&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/grafana&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/grafana&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/mgr-cfg&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/mgr-cfg&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/mgr-custom-info&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/mgr-custom-info&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/mgr-osad&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/mgr-osad&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/mgr-push&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/mgr-push&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/mgr-virtualization&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/mgr-virtualization&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/rhnlib&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/rhnlib&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/spacewalk-koan&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/spacewalk-koan&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/spacewalk-oscap&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/spacewalk-oscap&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/suseRegisterInfo&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/suseRegisterInfo&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Manager%20Client%20Tools%2015
>= 6.0.0, < 6.7.6+ 50 more
- (no CPE)range: >= 6.0.0, < 6.7.6
- (no CPE)range: < 2.9.21-lp152.2.7.1
- (no CPE)range: < 2.9.21-1.5.1
- (no CPE)range: < 0.1.1627546504.96a0b3e-lp152.2.26.1
- (no CPE)range: < 0.1.1627546504.96a0b3e-1.27.1
- (no CPE)range: < 2.27.1-lp152.3.13.1
- (no CPE)range: < 7.5.7-lp152.2.16.1
- (no CPE)range: < 7.5.7-3.12.1
- (no CPE)range: < 7.5.7-1.2
- (no CPE)range: < 4.2.3-1.18.1
- (no CPE)range: < 4.2.2-1.12.1
- (no CPE)range: < 4.2.6-1.30.1
- (no CPE)range: < 4.2.3-1.12.1
- (no CPE)range: < 4.2.2-1.20.1
- (no CPE)range: < 4.2.4-3.28.1
- (no CPE)range: < 4.2.11-3.62.1
- (no CPE)range: < 4.2.12-3.44.1
- (no CPE)range: < 4.2.4-3.21.1
- (no CPE)range: < 4.2.2-3.12.1
- (no CPE)range: < 4.2.4-3.15.1
- (no CPE)range: < 4.2.5-1.15.1
- (no CPE)range: < 2.9.21-1.5.1
- (no CPE)range: < 0.1.1627546504.96a0b3e-1.27.1
- (no CPE)range: < 2.27.1-1.29.2
- (no CPE)range: < 2.27.1-3.31.1
- (no CPE)range: < 7.5.7-1.21.2
- (no CPE)range: < 7.5.7-1.21.1
- (no CPE)range: < 4.2.3-1.18.2
- (no CPE)range: < 4.2.3-1.18.1
- (no CPE)range: < 4.2.2-1.12.2
- (no CPE)range: < 4.2.2-1.12.1
- (no CPE)range: < 4.2.6-1.30.2
- (no CPE)range: < 4.2.6-1.30.1
- (no CPE)range: < 4.2.3-1.12.2
- (no CPE)range: < 4.2.3-1.12.1
- (no CPE)range: < 4.2.2-1.20.2
- (no CPE)range: < 4.2.2-1.20.1
- (no CPE)range: < 4.2.4-21.34.2
- (no CPE)range: < 4.2.4-3.28.1
- (no CPE)range: < 4.2.11-38.85.2
- (no CPE)range: < 4.2.11-3.62.1
- (no CPE)range: < 4.2.12-52.53.2
- (no CPE)range: < 4.2.12-3.44.1
- (no CPE)range: < 4.2.4-24.24.2
- (no CPE)range: < 4.2.4-3.21.1
- (no CPE)range: < 4.2.2-19.18.2
- (no CPE)range: < 4.2.2-3.12.1
- (no CPE)range: < 4.2.4-25.18.2
- (no CPE)range: < 4.2.4-3.15.1
- (no CPE)range: < 4.2.5-1.15.2
- (no CPE)range: < 4.2.5-1.15.1

Patches

Vulnerability mechanics

References

community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724nvdVendor Advisory
community.grafana.com/t/release-notes-v6-7-x/27119nvdRelease NotesVendor Advisory
grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/nvdRelease NotesVendor Advisory
grafana.com/docs/grafana/latest/release-notes/release-notes-7-3-10/nvdRelease NotesVendor Advisory
grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/nvdRelease NotesVendor Advisory
grafana.com/products/enterprise/nvdProductVendor Advisory
security.netapp.com/advisory/ntap-20210430-0005/nvdThird Party Advisory
www.openwall.com/lists/oss-security/2021/03/19/5nvdMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000