CVE-2026-42127: Pre-authentication denial of service in the public dashboard query endpoint
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42127?
CVE-2026-42127 has a severity rating of 7.5, indicating a high risk level.
How does CVE-2026-42127 impact Grafana?
CVE-2026-42127 allows unauthenticated attackers to send excessively large JSON payloads to the public dashboard, leading to a denial of service.
How can I mitigate the risks associated with CVE-2026-42127?
To mitigate CVE-2026-42127, implement input size limits for the public dashboard query endpoint to prevent memory exhaustion.
What is the primary vulnerability type of CVE-2026-42127?
CVE-2026-42127 is primarily a denial of service vulnerability due to excessive memory allocation.
Is authentication required to exploit CVE-2026-42127?
No, CVE-2026-42127 can be exploited by unauthenticated attackers.