1. Home
  2. CVE Database
  3. CVE-2026-42127
HIGH · 7.5

CVE-2026-42127

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payl...

Vulnerability Description

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
GrafanaGrafana<= 11.6.14

Related Weaknesses (CWE)

CWE-770CWE-400

References

FAQ

What is CVE-2026-42127?

CVE-2026-42127 is a vulnerability with a CVSS score of 7.5 (HIGH). The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payl...

How severe is CVE-2026-42127?

CVE-2026-42127 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-42127?

Check the references section above for vendor advisories and patch information. Affected products include: Grafana Grafana.