CVE-2026-42127: Grafana Unauthenticated Denial-of-Service via Request Body Size

Technical summary

CVE-2026-42127 exploits insufficient input validation in Grafana's public dashboard query endpoint. The endpoint accepts unauthenticated requests and processes JSON payloads without enforcing request body size limits, enabling attackers to trigger excessive memory allocation. The vulnerability maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). With a CVSS v3.1 score of 7.5 (HIGH severity), the attack vector is network-based, requires no authentication, no user interaction, and results in a complete denial of availability to legitimate users.

Business impact

Organizations running Grafana as a monitoring or visualization platform face potential service interruptions. Public dashboard endpoints, often used for executive dashboards, team views, or integration with third-party tools, become attack surface. A successful exploit can render dashboards inaccessible, disrupting incident response workflows, SLA monitoring, and data-driven decision-making. Attackers need only a network path to the Grafana instance; no insider knowledge or valid credentials are required. Repeated attacks could signal the beginning of a broader incident or be paired with other attack objectives.

Affected systems

Grafana (all versions implementing the public dashboard query endpoint without request size validation) is affected. Organizations should consult the official Grafana security advisory to identify the specific versions in scope and whether their deployment includes publicly accessible dashboard query endpoints. The vulnerability applies equally to on-premise and cloud-hosted Grafana instances that expose this endpoint to untrusted networks.

Exploitability

The vulnerability is straightforward to exploit: an attacker sends a simple HTTP POST with a large JSON body to the public dashboard query endpoint. No authentication, API key, or special user interaction is needed. Exploitation requires only network connectivity and knowledge of the endpoint URL. Public Grafana instances discovered through scanning or documentation are immediately at risk. The low barrier to exploitation and the lack of defensive signals make this an attractive target for both opportunistic attackers and those conducting reconnaissance.

Remediation

Verify the applicable Grafana security advisory for the specific patched versions addressing this vulnerability. Apply the recommended patch immediately, prioritizing environments with public or less-restricted dashboard endpoints. Until patches are applied, consider implementing external request size limits via reverse proxy (nginx, HAProxy, or cloud load balancer) to reject payloads exceeding a reasonable threshold (e.g., 1–10 MB depending on legitimate dashboard query patterns). Restrict network access to the Grafana instance using firewall rules or VPC controls where feasible.

Patch guidance

Consult the official Grafana security advisory for version-specific patches. Apply patches to development, staging, and production environments in sequence. Verify that request size limits are enforced post-patch by testing with oversized payloads. Review Grafana's release notes to confirm no breaking changes or configuration adjustments are necessary. If you are unable to patch immediately, implement compensating controls at the network perimeter (see remediation_summary).

Detection guidance

Monitor Grafana logs and upstream proxy/WAF logs for HTTP requests to the public dashboard query endpoint with unusually large Content-Length headers or request body sizes. Baseline typical dashboard query sizes within your environment and alert on outliers. Inspect error logs for out-of-memory (OOM) kills, crashes, or abnormal memory spikes. Network-based detection can identify POST requests with payloads significantly exceeding normal patterns. Configure rate limiting and connection throttling on the public endpoint to slow brute-force or volumetric exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.5), unauthenticated exploitability, and low operational complexity. Unlike vulnerabilities requiring authentication or user interaction, this attack can be mounted by any network-accessible attacker in seconds. Public Grafana instances are discoverable and likely targets for opportunistic attackers. The denial-of-service impact disrupts monitoring and observability, which are critical to incident response and operational visibility. While not rated for active exploitation in the KEV catalog at present, the ease of exploitation means active attacks are probable as awareness spreads.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects HIGH severity because: (1) Network-based attack vector requires no authentication or special privileges; (2) Availability is completely compromised when memory is exhausted; (3) No user interaction is needed to trigger the condition; (4) The attack is trivial to execute with standard tools; (5) Impact is organization-wide for the affected service. The vulnerability does not affect confidentiality or integrity, limiting the score from CRITICAL, but the guaranteed denial-of-service impact and unauthenticated nature justify the HIGH classification.

Frequently asked questions