CVE-2026-42127

Modified Modified - Updated After Analysis

Memory Exhaustion in Grafana Public Dashboard Query Endpoint

Publication date: 2026-06-22

Last updated on: 2026-07-10

Assigner: Grafana Labs

Description

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-07-10

Generated

2026-07-13

AI Q&A

2026-06-22

EPSS Evaluated

2026-07-11

NVD

CVE-2026-42127

EUVD

EUVD-2026-38309

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	grafana	to 11.6.14 (inc)
grafana	grafana	From 12.3.0 (inc) to 12.3.6 (inc)
grafana	grafana	From 12.4.0 (inc) to 12.4.3 (inc)
grafana	grafana	From 13.0.0 (inc) to 13.0.1 (inc)
grafana	grafana	From 12.2.0 (inc) to 12.2.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the public dashboard query endpoint of Grafana. It does not limit the size of the request body before processing, which allows unauthenticated attackers to send very large JSON payloads.

Because there is no restriction on the size of the input, attackers can cause excessive memory allocation on the server.

This can lead to a denial of service (DoS) condition due to memory exhaustion.

No valid dashboard access token or authentication is required to exploit this vulnerability.

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) condition.

An attacker can cause the Grafana server to consume excessive memory by sending large JSON payloads to the public dashboard query endpoint.

This memory exhaustion can cause the server to become unresponsive or crash, disrupting service availability.

Since no authentication is required, the attack can be performed by anyone, increasing the risk.

Hi! I’m here to help you understand CVE-2026-42127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70