Fluid Attacks Database

Description

Grafana: Pre-authentication denial of service in the public dashboard query handler The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel10	grafana	<0:10.2.6-28.el10_2.4	0:10.2.6-28.el10_2.4
rpm rhel10.0	grafana	<0:10.2.6-26.el10_0	0:10.2.6-26.el10_0
rpm rhel8	grafana	<0:9.2.10-32.el8_10.1	0:9.2.10-32.el8_10.1
rpm rhel9	grafana	<0:10.2.6-23.el9_8.1	0:10.2.6-23.el9_8.1
rpm rhel9.6	grafana	<0:10.2.6-23.el9_6	0:10.2.6-23.el9_6
go	github.com/grafana/grafana	>=2.0.0-beta1 <11.6.15 \|\| >=12.0.0 <12.2.9 \|\| >=12.3.0 <12.3.7 \|\| >=12.4.0 <12.4.4 \|\| >=13.0.0 <13.0.2 \|\| >=0 <1.9.2-0.20260616075434-82ef13993059	1.9.2-0.20260616075434-82ef13993059

Aliases

1. CVE-2026-421272. NVD-2026-421273. OSV-2026-421274. GCVE-2026-42127

References

1. https://github.com/grafana/grafana/pull/1257892. https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f43. https://github.com/grafana/grafana/releases/tag/v11.6.154. https://github.com/grafana/grafana/releases/tag/v12.2.95. https://github.com/grafana/grafana/releases/tag/v12.3.76. https://github.com/grafana/grafana/releases/tag/v12.4.47. https://github.com/grafana/grafana/releases/tag/v13.0.28. https://grafana.com/security/security-advisories/cve-2026-42127

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.