CVE-2026-42127
Fixed in a distro release EPSS <1%CVSS 7.5
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Products: Grafana Enterprise, Grafana OSS
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | no fix |
| Go | github.com/grafana/grafana | 1.9.2-0.20260616075434-82ef13993059 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | grafana | 9.2.10-32.el8_10.1 |
| AlmaLinux 8 | grafana-selinux | 9.2.10-32.el8_10.1 |
| Chainguard | grafana-11.6 | 11.6.16-r2 |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | 12.2.10-r10 |
| Chainguard | grafana-12.3 | 12.3.7-r0 |
| Chainguard | grafana-12.4 | 12.4.4-r0 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | 12.2.10-r4 |
| Chainguard | grafana-fips-12.3 | 12.3.7-r0 |
| Chainguard | grafana-fips-12.4 | 12.4.4-r0 |
| Red Hat Enterprise Linux 10.2 | grafana | 0:10.2.6-28.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | grafana-debuginfo | 0:10.2.6-28.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | grafana-debugsource | 0:10.2.6-28.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | grafana-selinux | 0:10.2.6-28.el10_2.4 |
| Red Hat Enterprise Linux 8 | grafana | 0:9.2.10-32.el8_10.1 |
| Red Hat Enterprise Linux 8 | grafana-debuginfo | 0:9.2.10-32.el8_10.1 |
| Red Hat Enterprise Linux 8 | grafana-debugsource | 0:9.2.10-32.el8_10.1 |
| Red Hat Enterprise Linux 8 | grafana-selinux | 0:9.2.10-32.el8_10.1 |
| Red Hat Enterprise Linux 9 | grafana | 0:10.2.6-23.el9_8.1 |
| Red Hat Enterprise Linux 9 | grafana-debuginfo | 0:10.2.6-23.el9_8.1 |
| Red Hat Enterprise Linux 9 | grafana-debugsource | 0:10.2.6-23.el9_8.1 |
| Red Hat Enterprise Linux 9 | grafana-selinux | 0:10.2.6-23.el9_8.1 |
| Red Hat Enterprise Linux eus 10.0 | grafana | 0:10.2.6-26.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-debuginfo | 0:10.2.6-26.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-debugsource | 0:10.2.6-26.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-selinux | 0:10.2.6-26.el10_0 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.6-0.2.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.1-0.2.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.5.hum1 |
| Red Hat rhel e4s 9.4 | grafana | 0:9.2.10-28.el9_4 |
| Red Hat rhel e4s 9.4 | grafana-debuginfo | 0:9.2.10-28.el9_4 |
| Red Hat rhel e4s 9.4 | grafana-debugsource | 0:9.2.10-28.el9_4 |
| Red Hat rhel e4s 9.4 | grafana-selinux | 0:9.2.10-28.el9_4 |
| Red Hat rhel eus 9.6 | grafana | 0:10.2.6-23.el9_6 |
| Red Hat rhel eus 9.6 | grafana-debuginfo | 0:10.2.6-23.el9_6 |
| Red Hat rhel eus 9.6 | grafana-debugsource | 0:10.2.6-23.el9_6 |
| Red Hat rhel eus 9.6 | grafana-selinux | 0:10.2.6-23.el9_6 |
| Rocky Linux 8 | grafana | 0:9.2.10-32.el8_10.1 |
| Rocky Linux 9 | grafana | 0:10.2.6-23.el9_8.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 12.4.10-150200.3.94.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | system-user-grafana | 1.0.0-150200.5.8.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| Wolfi | grafana-12.3 | 12.3.7-r0 |
| Wolfi | grafana-12.4 | 12.4.4-r0 |
| openSUSE Leap 16.0 | grafana | 12.4.10-bp160.1.1 |
| openSUSE Tumbleweed | grafana | 12.4.5-3.1 |