Vulnerability-Lookup

CVE-2026-42127 (GCVE-0-2026-42127)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:31 – Updated: 2026-06-22 17:28

Title

Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler

Summary

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA

References

URL

Tags

https://grafana.com/security/security-advisories/…

vendor-advisory

Impacted products

Vendor

Product

Version

Grafana

Grafana Enterprise

Affected: 0 , ≤ 11.6.14 (semver)
Affected: 0 , ≤ 12.2.8 (semver)
Affected: 0 , ≤ 12.3.6 (semver)
Affected: 0 , ≤ 12.4.3 (semver)
Affected: 0 , ≤ 13.0.1 (semver)

Grafana

Grafana OSS

Affected: 11.6.0 , ≤ 11.6.14 (semver)
Affected: 12.2.0 , ≤ 12.2.8 (semver)
Affected: 12.3.0 , ≤ 12.3.6 (semver)
Affected: 12.4.0 , ≤ 12.4.3 (semver)
Affected: 13.0.0 , ≤ 13.0.1 (semver)

Credits

Charlie Lewis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:28:16.184877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:28:35.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Charlie Lewis"
        }
      ],
      "datePublic": "2026-05-24T15:38:07.115Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:31:28.096Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
        }
      ],
      "source": {
        "discovery": "EXTERNAL_REPORT"
      },
      "title": "Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-42127",
    "datePublished": "2026-06-22T16:31:28.096Z",
    "dateReserved": "2026-04-24T15:38:08.066Z",
    "dateUpdated": "2026-06-22T17:28:35.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42127\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-22T17:28:16.184877Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-22T17:28:30.549Z\"}}], \"cna\": {\"title\": \"Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler\", \"source\": {\"discovery\": \"EXTERNAL_REPORT\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Charlie Lewis\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}}], \"affected\": [{\"vendor\": \"Grafana\", \"product\": \"Grafana Enterprise\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.6.14\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.2.8\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.3.6\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.4.3\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"13.0.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Grafana\", \"product\": \"Grafana OSS\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.6.14\"}, {\"status\": \"affected\", \"version\": \"12.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.2.8\"}, {\"status\": \"affected\", \"version\": \"12.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.3.6\"}, {\"status\": \"affected\", \"version\": \"12.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.4.3\"}, {\"status\": \"affected\", \"version\": \"13.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"13.0.1\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-05-24T15:38:07.115Z\", \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2026-42127\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.\"}], \"providerMetadata\": {\"orgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"shortName\": \"GRAFANA\", \"dateUpdated\": \"2026-06-22T16:31:28.096Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42127\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-22T17:28:35.835Z\", \"dateReserved\": \"2026-04-24T15:38:08.066Z\", \"assignerOrgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"datePublished\": \"2026-06-22T16:31:28.096Z\", \"assignerShortName\": \"GRAFANA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42127

Vulnerability from fkie_nvd - Published: 2026-06-22 18:16 - Updated: 2026-06-30 14:49

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@grafana.com	https://grafana.com/security/security-advisories/cve-2026-42127	Broken Link

Impacted products

Vendor	Product	Version
grafana	grafana	*
grafana	grafana	*
grafana	grafana	*
grafana	grafana	*
grafana	grafana	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@grafana.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "BCCF12AE-CA32-42A8-9837-4EF45704D150",
              "versionEndIncluding": "11.6.14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E60EEF4D-DD52-4DB1-9E58-59B7EE4D1D9E",
              "versionEndIncluding": "12.2.8",
              "versionStartIncluding": "12.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "F0AF4DB6-120E-44EE-BF4D-E41FCBE88A77",
              "versionEndIncluding": "12.3.6",
              "versionStartIncluding": "12.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "8F22EAA5-D510-4261-9A3F-6AC315378F23",
              "versionEndIncluding": "12.4.3",
              "versionStartIncluding": "12.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "16FCDFDF-CD01-4A1C-B6DB-9C4B116374FB",
              "versionEndIncluding": "13.0.1",
              "versionStartIncluding": "13.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability."
    }
  ],
  "id": "CVE-2026-42127",
  "lastModified": "2026-06-30T14:49:20.790",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security@grafana.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42127",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-22T17:28:16.184877Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-22T18:16:37.430",
  "references": [
    {
      "source": "security@grafana.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
    }
  ],
  "sourceIdentifier": "security@grafana.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

bit-grafana-2026-42127

Vulnerability from bitnami_vulndb

Published

2026-06-26 08:43

Modified

2026-06-29 14:45

Summary

Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "grafana",
        "purl": "pkg:bitnami/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.6.0"
            },
            {
              "fixed": "11.6.15"
            },
            {
              "introduced": "12.2.0"
            },
            {
              "fixed": "12.2.9"
            },
            {
              "introduced": "12.3.0"
            },
            {
              "fixed": "12.3.7"
            },
            {
              "introduced": "12.4.0"
            },
            {
              "fixed": "12.4.4"
            },
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.0.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42127"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
      "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*"
    ],
    "severity": "High"
  },
  "details": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.",
  "id": "BIT-grafana-2026-42127",
  "modified": "2026-06-29T14:45:12.993Z",
  "published": "2026-06-26T08:43:07.401Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42127"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler"
}

GHSA-3W66-95M3-8JXG

Vulnerability from github – Published: 2026-06-22 18:34 – Updated: 2026-06-22 18:34

Details

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-42127"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-22T18:16:37Z",
    "severity": "HIGH"
  },
  "details": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.",
  "id": "GHSA-3w66-95m3-8jxg",
  "modified": "2026-06-22T18:34:17Z",
  "published": "2026-06-22T18:34:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42127"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42127 (GCVE-0-2026-42127)

FKIE_CVE-2026-42127

bit-grafana-2026-42127

Vulnerability from bitnami_vulndb

GHSA-3W66-95M3-8JXG

Tags

Sightings

Nomenclature