# CVE-2026-42127: Grafana denial of service in public dashboard query endpoint

Source: https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-42127 · Severity: high · CVSS 7.5 · Published 2026-06-22

Grafana, a popular data visualization and monitoring platform, contains a vulnerability in its public dashboard feature. An unauthenticated attacker can send a specially crafted large request to the server, causing it to run out of memory and crash. This results in a denial of service, making dashboards and monitoring data unavailable to legitimate users.

Technologies: [github.com/grafana/grafana (Go)](https://junglewise.ai/threats/technologies/github-com-grafana-grafana), [Grafana Labs Grafana Enterprise](https://junglewise.ai/threats/technologies/grafana-enterprise), [Grafana Labs Grafana OSS](https://junglewise.ai/threats/technologies/grafana-oss). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Grafana Labs](https://junglewise.ai/threats/vendors/grafana-labs).

## Quick answers

**Is CVE-2026-42127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42127 being exploited in the wild.

**How severe is CVE-2026-42127?** High severity, with a CVSS score of 7.5, published 22 June 2026.

**Which products and versions are affected?** github.com/grafana/grafana (Go) SEMVER:introduced=0, SEMVER:introduced=2.0.0-beta1; Grafana Labs Grafana Enterprise <= 11.6.14, <= 12.2.8, <= 12.3.6, <= 12.4.3, <= 13.0.1; Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1.

**Is there a fix for CVE-2026-42127?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42127 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42127?** Check whether you run github.com/grafana/grafana (Go), Grafana Labs Grafana Enterprise or Grafana Labs Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in Grafana's public dashboard query endpoint due to a lack of request body size validation. An unauthenticated attacker can exploit this by sending an arbitrarily large JSON payload over the network. The server attempts to process the entire payload, leading to excessive memory allocation and eventual process termination via memory exhaustion. No valid dashboard access token or authentication is required for exploitation. The vulnerability affects both Grafana OSS and Enterprise editions across several version branches.

## Affected products

- Grafana Grafana Enterprise <= 11.6.14, <= 12.2.8, <= 12.3.6, <= 12.4.3, <= 13.0.1
- Grafana Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1

## Identifiers

- CVE-2026-42127
- GHSA-3w66-95m3-8jxg
- GO-2026-6541

## Timeline

- 2026-06-22: disclosed: Initial publication of CVE-2026-42127

## References

- [https://grafana.com/security/security-advisories/cve-2026-42127](https://grafana.com/security/security-advisories/cve-2026-42127)

## Related threats

- [Grafana incorrect access control in public dashboard deletion](https://junglewise.ai/threats/cve-2026-28378-grafana-incorrect-access-control-in-public-dashboard-deletion)
- [Grafana OSS stored XSS in geomap panel XYZ tile layer](https://junglewise.ai/threats/cve-2026-9029-grafana-oss-stored-xss-in-geomap-panel-xyz-tile-layer)
- [Grafana Loki datasource plugin path traversal in callResource handler](https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource)
- [Grafana Tempo and Loki plugins path traversal](https://junglewise.ai/threats/cve-2026-10601-grafana-tempo-and-loki-plugins-path-traversal)
- [Grafana improper access control in service account token minting](https://junglewise.ai/threats/cve-2026-33381-grafana-improper-access-control-in-service-account-token-minting)