CVE-2026-42127

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memory exhaustion.

This is an Important denial of service vulnerability in Grafana, affecting Red Hat products that include Grafana. Unauthenticated remote attackers can exploit the public dashboard query endpoint by sending large JSON payloads, leading to excessive memory allocation and potential service disruption. The absence of authentication requirements for exploitation increases the risk of widespread impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the Grafana instance to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Grafana service port. If Grafana is exposed via a reverse proxy, ensure the proxy is configured to limit request body sizes to prevent large payloads from reaching Grafana. A service restart may be required for network configuration changes to take effect.