CVE-2026-42127
Awaiting Analysis Awaiting Analysis - Queue
Memory Exhaustion in Grafana Public Dashboard Query Endpoint

Publication date: 2026-06-22

Last updated on: 2026-06-22

Assigner: Grafana Labs

Description
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-22
Last Modified
2026-06-22
Generated
2026-06-23
AI Q&A
2026-06-22
EPSS Evaluated
N/A
NVD
CVE-2026-42127
EUVD
EUVD-2026-38309
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
grafana grafana *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the public dashboard query endpoint of Grafana. It does not limit the size of the request body before processing, which allows unauthenticated attackers to send very large JSON payloads.

Because there is no restriction on the size of the input, attackers can cause excessive memory allocation on the server.

This can lead to a denial of service (DoS) condition due to memory exhaustion.

No valid dashboard access token or authentication is required to exploit this vulnerability.

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) condition.

An attacker can cause the Grafana server to consume excessive memory by sending large JSON payloads to the public dashboard query endpoint.

This memory exhaustion can cause the server to become unresponsive or crash, disrupting service availability.

Since no authentication is required, the attack can be performed by anyone, increasing the risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42127. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart