Skip to content
OpenAdvisories
High RHSA-2026:54184 1 CVE

Red Hat Security Advisory: grafana security update

Published Sep 17, 2026 · Updated Oct 7, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana 0:10.2.6-23.el9_8.1
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debuginfo 0:10.2.6-23.el9_8.1
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debugsource 0:10.2.6-23.el9_8.1
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-selinux 0:10.2.6-23.el9_8.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-42127

    Pre-authentication denial of service in the public dashboard query endpoint

    The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exh…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491449
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54184.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-42127
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42127
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42127
  • article
    https://grafana.com/security/security-advisories/cve-2026-42127