Executive brief
Grafana, a popular data visualization and monitoring platform, contains a vulnerability in its public dashboard feature. An unauthenticated attacker can send a specially crafted large request to the server, causing it to run out of memory and crash. This results in a denial of service, making dashboards and monitoring data unavailable to legitimate users.
Technical details
A denial of service vulnerability exists in Grafana's public dashboard query endpoint due to a lack of request body size validation. An unauthenticated attacker can exploit this by sending an arbitrarily large JSON payload over the network. The server attempts to process the entire payload, leading to excessive memory allocation and eventual process termination via memory exhaustion. No valid dashboard access token or authentication is required for exploitation. The vulnerability affects both Grafana OSS and Enterprise editions across several version branches.
Affected products
- Grafana Grafana Enterprise <= 11.6.14, <= 12.2.8, <= 12.3.6, <= 12.4.3, <= 13.0.1
- Grafana Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1
Timeline
- 2026-06-22: disclosed: Initial publication of CVE-2026-42127