7.5
High
CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated…
Description
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Grafana Enterprise 13.0 | 13.0.0 → 13.0.1 | No fix stated |
| Grafana Enterprise 12.4 | 12.4.0 → 12.4.3 | No fix stated |
| Grafana Enterprise 12.3 | 12.3.0 → 12.3.6 | No fix stated |
| Grafana Enterprise 12.2 | 12.2.0 → 12.2.8 | No fix stated |
| Grafana Enterprise 11.6 | 11.6.0 → 11.6.14 | No fix stated |
| Grafana OSS 13.0 | 13.0.0 → 13.0.1 | No fix stated |
| Grafana OSS 12.4 | 12.4.0 → 12.4.3 | No fix stated |
| Grafana OSS 12.3 | 12.3.0 → 12.3.6 | No fix stated |
| Grafana OSS 12.2 | 12.2.0 → 12.2.8 | No fix stated |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Grafana OSS 11.6 | 11.6.0 → 11.6.14 | No fix stated |
References
- grafana.com grafana.com
Timeline
- Published
- Last modified
Other CVEs of Grafana Enterprise
The 40 CVEs of Grafana Enterprise →
CVE-2026-79656
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
6.0
Medium
CVE-2026-103506
SSO settings authorization bypass
8.9
High
CVE-2026-88858
Server-side expression parser denial of service
6.5
Medium
CVE-2026-88967
Azure Monitor access token disclosure via SSRF
7.7
High