CVE-2026-42127

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description The public dashboard query endpoint does not limit the request body size before processing. This allows unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads, which can lead to a denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.