Elasticsearch Memory Allocation Issue in Grafana by Grafana Labs

CVE-2026-81843

What is CVE-2026-81843?

Grafana's integration with Elasticsearch allows users to configure data sources for monitoring, but a vulnerability arises when a time-based index pattern is utilized. In this scenario, Grafana generates multiple index names for each interval within the chosen time range without any limiting constraints. This can lead to excessive memory allocation if a user with query permissions, including those with merely the Viewer role, issues a seemingly innocuous query spanning a vast time frame. Even before any request reaches the Elasticsearch instance, the server may begin allocating memory continuously, potentially causing it to become unresponsive. However, setups using a static index name remain unaffected.

References