Denial of Service Risk in Grafana Dashboard Due to Unrestricted Query Size

CVE-2026-42127

What is CVE-2026-42127?

This vulnerability allows unauthenticated attackers to exploit the public dashboard query endpoint by sending enormous JSON payloads. The lack of request body size limitations can lead to excessive memory allocation, ultimately resulting in denial of service as system resources are consumed. Notably, the attack can be executed without any valid dashboard access token or authentication, making it particularly concerning for Grafana users.

References