Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-81843 EUVD-2026-124572GHSA-3j77-c63g-qm4j

Grafana is an open-source platform for monitoring and observability. When an Elasticsearch data source is configured with a time-based inde…

Published Nov 12, 2026 · Assigned by GRAFANA

Description

Grafana is an open-source platform for monitoring and observability.

When an Elasticsearch data source is configured with a time-based index pattern, Grafana
generated one index name for every interval in the requested query time range without any upper
limit. A user with permission to query the data source, which includes users holding only the
Viewer role in a default configuration, could submit a single small query with an extreme time
range and cause the server to allocate memory until it was terminated. The allocation occurred
before any request was sent to Elasticsearch, so the condition applied whether or not the
Elasticsearch cluster was reachable.

Data sources configured with a static index name are not affected.

Affected products

VendorProductAffectedFixed
Grafana Grafana Enterprise 12.3.0 <12.4.15 —
Grafana Grafana OSS 12.0.0 ≤12.2.10 —
Grafana Grafana OSS 11.6.0 ≤11.6.16 —
Grafana Grafana OSS 12.3.0 <12.4.15 —
Grafana Grafana Enterprise 11.6.0 ≤11.6.16 —
Grafana Grafana Enterprise 12.0.0 ≤12.2.10 —
Grafana Elasticsearch Datasource 12.4.2 <12.9.6 —

References