Description
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 11.6.0 – ≤ 11.6.14, 12.2.0 – ≤ 12.2.8, 12.3.0 – ≤ 12.3.6, 12.4.0 – ≤ 12.4.3, 13.0.0 – ≤ 13.0.1 | — |
| Grafana | Grafana OSS | 11.6.0 – ≤ 11.6.14, 12.2.0 – ≤ 12.2.8, 12.3.0 – ≤ 12.3.6, 12.4.0 – ≤ 12.4.3, 13.0.0 – ≤ 13.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | grafana +1 | 10.2.6-28.el10_2.4 | RHSA-2026:54178 |
| RHEL 9 | grafana +1 | 10.2.6-23.el9_8.1 | RHSA-2026:54184 |
| RHEL 8 | grafana +1 | 9.2.10-32.el8_10.1 | RHSA-2026:54243 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | grafana +1 | 10.2.6-26.el10_0 | RHSA-2026:67517 |
| RHEL 9.6 EUS | grafana +1 | 10.2.6-23.el9_6 | RHSA-2026:67518 |
| RHEL 9.4 E4S | grafana +1 | 9.2.10-28.el9_4 | RHSA-2026:76795 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.6-0.2.hum1 | RHSA-2026:47619 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.2.hum1 | RHSA-2026:47618 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.5.hum1 | RHSA-2026:68778 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | grafana +1 | 10.2.6-28.el10_2.4 | ALSA-2026:54178 |
| AlmaLinux 9 | grafana +1 | 10.2.6-23.el9_8.1 | ALSA-2026:54184 |
| AlmaLinux 8 | grafana +1 | 9.2.10-32.el8_10.1 | ALSA-2026:54243 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | grafana | 10.2.6-23.el9_8.1 | RLSA-2026:54184 |
| Rocky Linux 8 | grafana | 9.2.10-32.el8_10.1 | RLSA-2026:54243 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | grafana | 12.4.10-150200.3.94.3 | SUSE-SU-2026:4600-1 |
| SLES 15 SP7 | system-user-grafana | 1.0.0-150200.5.8.1 | SUSE-SU-2026:4600-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 12.4.5-3.1 | openSUSE-SU-2026:11332-1 |
| openSUSE Leap 16.0 | grafana | 12.4.10-bp160.1.1 | openSUSE-SU-2026:22125-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.4-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | grafana +1 | 10.2.6-23.el9_8.1 | ELSA-2026-54184 |
| Oracle Linux 8 | grafana +1 | 9.2.10-32.0.1.el8_10.1 | ELSA-2026-54243 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | 12.3.7-r0 | — |
| Wolfi rolling | grafana-12.4 | 12.4.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 2.0.0-beta1 | — | GHSA-3w66-95m3-8jxg |
| Go | github.com/grafana/grafana | >= 12.0.0 | — | GHSA-3w66-95m3-8jxg |
| Go | github.com/grafana/grafana | >= 12.3.0 | — | GHSA-3w66-95m3-8jxg |
| Go | github.com/grafana/grafana | >= 12.4.0 | — | GHSA-3w66-95m3-8jxg |
| Go | github.com/grafana/grafana | >= 13.0.0 | — | GHSA-3w66-95m3-8jxg |
| Go | github.com/grafana/grafana | < 1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 | GHSA-3w66-95m3-8jxg |
| Go | github.com/grafana/grafana | all versions | — | GO-2026-6541 |
| Go | github.com/grafana/grafana | >= 2.0.0-beta1+incompatible | — | GO-2026-6541 |
Advisories 20
- ALSA-2026:54178 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54184 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54243 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2026:22125-1 Security update for grafana SUSE / openSUSE Security Updates · Oct 20, 2026
- RHSA-2026:76795 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67518 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67517 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:47619 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68778 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:54243 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:54178 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- SUSE-SU-2026:4600-1 Security update for grafana, system-user-grafana SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- RHSA-2026:54184 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RHSA-2026:47618 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RLSA-2026:54243 Important: grafana security update Rocky Linux Security Advisories · Sep 16, 2026
- RLSA-2026:54184 Important: grafana security update Rocky Linux Security Advisories · Sep 16, 2026
- ELSA-2026-54184 Important: grafana security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026
- ELSA-2026-54243 Important: grafana security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 13, 2026
- openSUSE-SU-2026:11332-1 grafana-12.4.5-3.1 on GA media SUSE / openSUSE Security Updates · Jul 23, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-42127 vendor-advisory