CVE-2026-42127

high Grafana
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.4%
Exploitation probability in 30 days
Top 65% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Published: June 22, 2026 (17 days ago)
Last Modified: June 30, 2026
Vendor: Grafana
Source: NVD

Description

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

CWE

CWE-770

Affected Products

grafana grafana

References

🔗 grafana.com