CVE-2026-42127 Pre-authentication denial of service in the public dashboard query endpoint
Unauthenticated attackers can cause denial of service in Grafana by sending large JSON payloads to the public dashboard query endpoint, exhausting server memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42127?
CVE-2026-42127 is a high-severity denial of service vulnerability in Grafana Grafana, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Which versions are affected by CVE-2026-42127?
15 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260616075434-82ef13993059 |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260616075434-82ef13993059 |
github.com/grafana/grafana Go | From 12.0.0 | None |
github.com/grafana/grafana Go | From 12.0.0 | None |
github.com/grafana/grafana Go | From 12.3.0 | None |
9 more packages
github.com/grafana/grafana Go | From 12.3.0 | None |
github.com/grafana/grafana Go | From 12.4.0 | None |
github.com/grafana/grafana Go | From 12.4.0 | None |
github.com/grafana/grafana Go | From 13.0.0 | None |
github.com/grafana/grafana Go | From 13.0.0 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1 | None |
github.com/grafana/grafana Go | From 2.0.0-beta1+incompatible | None |
grafana Bitnami | All versions | 11.6.15, 12.2.9, 12.3.7, 12.4.4, 12.2.9, 12.3.7, 12.4.4, 13.0.2 |
Linux distribution packages (7)
grafana AlmaLinux:9 | All versions | 10.2.6-23.el9_8.1 |
grafana-selinux AlmaLinux:9 | All versions | 10.2.6-23.el9_8.1 |
grafana Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-23.el9_8.1 |
grafana-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-23.el9_8.1 |
grafana-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-23.el9_8.1 |
grafana-selinux Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-23.el9_8.1 |
grafana Rocky Linux:9 | All versions | 0:10.2.6-23.el9_8.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-42127?
Upgrade github.com/grafana/grafana to 1.9.2-0.20260616075434-82ef13993059 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42127 being exploited?
There is no known exploitation of CVE-2026-42127 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as ALSA-2026:54184, BIT-grafana-2026-42127, CLSA-2026-1783354657, GHSA-3w66-95m3-8jxg, GO-2026-6541, MINI-2mgv-wr45-cxgp and 16 more.