CVE-2026-42127: Public Dashboard Query DoS Vulnerability

CVE-2026-42127 Overview

CVE-2026-42127 is a denial-of-service vulnerability in the Grafana public dashboard query endpoint. The endpoint fails to enforce a request body size limit before processing incoming data. Unauthenticated attackers can submit arbitrarily large JSON payloads to trigger excessive memory allocation. Sustained exploitation exhausts process memory and renders the Grafana instance unavailable.

The flaw maps to CWE-770: Allocation of Resources Without Limits or Throttling. No dashboard access token, session, or credentials are required to reach the vulnerable code path. Any network-reachable Grafana instance exposing public dashboards is affected.

Critical Impact
Unauthenticated remote attackers can crash Grafana instances by sending oversized JSON bodies to the public dashboard query endpoint, causing service-wide outage of dashboards and alerting.

Affected Products

Grafana (versions disclosed in the vendor advisory)
Grafana deployments exposing public dashboards to untrusted networks
Self-hosted and containerized Grafana instances using the affected query endpoint

Discovery Timeline

2026-06-22 - CVE-2026-42127 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-42127

Vulnerability Analysis

The public dashboard query endpoint accepts JSON request bodies without applying a maximum-size constraint before deserialization. When a client posts a large payload, the server allocates buffers proportional to the payload size to parse and process the request. An attacker can deliberately submit JSON bodies of arbitrary size to consume server memory.

Because the endpoint is designed for unauthenticated public dashboard consumers, no token validation gates the parsing step. The allocation occurs before any authorization, schema validation, or size sanity check completes. A single concurrent burst of oversized requests can saturate available heap, forcing the Go runtime into garbage-collection pressure or out-of-memory termination.

The vulnerability does not expose data or allow code execution. Impact is restricted to availability of the Grafana service and any alerting workflows that depend on it.

Root Cause

The root cause is missing input throttling on an unauthenticated HTTP endpoint. The handler reads the full request body into memory and invokes JSON decoding without an http.MaxBytesReader wrapper or equivalent body-size cap. This is a classic [CWE-770] resource-exhaustion pattern where input volume controls server-side allocation.

Attack Vector

Exploitation requires only network access to the Grafana HTTP listener. An attacker crafts a POST request to the public dashboard query path with a JSON body sized in the hundreds of megabytes or larger. Repeating the request in parallel multiplies the memory pressure across worker goroutines. The Grafana process either becomes unresponsive or is killed by the operating system out-of-memory killer.

No authentication, user interaction, or prior reconnaissance is required. Public dashboards exposed to the internet are reachable by any anonymous client. See the Grafana Security Advisory CVE-2026-42127 for endpoint-specific details.

Detection Methods for CVE-2026-42127

Indicators of Compromise

Unusually large Content-Length values on POST requests to public dashboard query paths under /api/public/dashboards/
Repeated requests from a small set of source IPs targeting the public dashboard query endpoint within a short window
Grafana process restarts, OOM-killer log entries, or cgroup memory-limit events on the host running Grafana
Spikes in Go runtime heap metrics (go_memstats_heap_alloc_bytes) correlated with inbound traffic to public dashboard endpoints

Detection Strategies

Inspect HTTP access logs for POST requests to public dashboard query routes with Content-Length exceeding a few megabytes
Alert on Grafana process memory consumption crossing a defined threshold relative to baseline
Correlate Grafana service restarts with concurrent inbound request volume to identify exploitation attempts
Apply WAF or reverse-proxy rules that log and flag oversized request bodies sent to unauthenticated endpoints

Monitoring Recommendations

Export Grafana process metrics and host memory metrics to a centralized monitoring system with alerting on anomalies
Enable detailed HTTP access logging on the reverse proxy fronting Grafana, capturing request size and source IP
Track request rate and payload size distribution per source IP for the public dashboard endpoints
Review historical logs after patching to identify prior exploitation attempts

How to Mitigate CVE-2026-42127

Immediate Actions Required

Upgrade Grafana to the fixed version listed in the Grafana Security Advisory CVE-2026-42127
Place Grafana behind a reverse proxy or WAF that enforces a strict maximum request body size on public dashboard routes
Disable public dashboards entirely if the feature is not required in your deployment
Restrict network exposure of Grafana to trusted networks where feasible

Patch Information

Grafana has published fixed versions in its security advisory. Review the Grafana Security Advisory CVE-2026-42127 for the exact patched releases and apply the upgrade across all instances. After upgrading, verify the public dashboard query endpoint enforces a body-size limit by submitting a test oversized payload and confirming a 413 Payload Too Large response.

Workarounds

Configure an upstream NGINX or HAProxy proxy with client_max_body_size set to a low value such as 1m for public dashboard paths
Disable the public dashboards feature flag in grafana.ini until the patch can be applied
Apply rate limiting on the public dashboard query endpoint at the reverse proxy or WAF layer
Set OS-level memory limits via systemd MemoryMax or container memory limits to prevent host-wide impact

bash

# NGINX reverse proxy mitigation: cap body size on public dashboard endpoints
location /api/public/dashboards/ {
    client_max_body_size 1m;
    limit_req zone=grafana_public burst=10 nodelay;
    proxy_pass http://grafana_upstream;
}

# grafana.ini: disable public dashboards until patched
[feature_toggles]
publicDashboards = false