CVE-2026-42127

Executive Summary

CVE-2026-42127 is a pre-authentication denial-of-service (DoS) vulnerability in Grafana's public dashboard query endpoint, caused by the absence of request body size limits prior to processing. This allows unauthenticated remote attackers to submit arbitrarily large JSON payloads, triggering excessive memory allocation that can exhaust server resources and crash the instance. All Grafana deployments exposing public dashboards are affected, with a CVSS base score of 7.5 (High) and no authentication or dashboard access token required for exploitation. The vulnerability carries a moderate EPSS score of 0.00432, indicating limited active exploitation in the wild, and has a public PoC available via Nuclei template (though no standalone exploit code has been released).

Technical Analysis

The vulnerability resides in Grafana's public dashboard query endpoint, which handles JSON request bodies without enforcing any size constraints before parsing. The root cause is a missing http.MaxBytesReader or equivalent content-length validation on the incoming request stream. When Grafana's HTTP handler receives a POST request to the public dashboard query endpoint, it deserializes the JSON payload using json.Unmarshal or a similar decoder. Without a size limit, the decoder will allocate memory proportional to the JSON structure's complexity and nesting depth before any business logic validation occurs.

The attack surface is the public dashboard feature, which is designed to allow unauthenticated access to specific dashboards shared via a public token. The endpoint accepts POST requests containing query filters, time ranges, and other dashboard-specific parameters. The vulnerability is triggered when an attacker crafts a JSON payload with extreme nesting (e.g., arrays within arrays up to 10,000+ levels deep) or uses large string blobs. During JSON parsing, Go's standard library expands these into in-memory objects, and deeply nested structures cause exponential stack/memory growth during recursive descent.

The attack does not require reaching the application's query execution logic — the memory exhaustion occurs during the parsing phase itself. This is critical because it means the vulnerability is exploitable even before Grafana validates the dashboard token or applies permissions. The endpoint's routing table in Grafana's codebase does not invoke http.MaxBytesReader on the request body, and the handler chain lacks middleware that enforces request size limits.

The CWE-770 classification (Allocation of Resources Without Limits or Throttling) is accurate. The absence of a request body limit combined with the CPU/memory cost of JSON deserialization creates an amplification factor: a single HTTP request of ~1MB of JSON can cause 100-500MB of memory allocation during parsing, depending on nesting strategy. Once memory is exhausted, the Grafana process either panics (Go runtime out-of-memory) or the Linux kernel's OOM killer terminates the process, causing complete service unavailability.

Affected versions are unclear from the advisory, but OSV package data suggests the vulnerability is present in all versions up to the fix commit. The fix commits referenced are 92f1fba9b4b6700328e99e97328d6639df8ddc3d and 20051fb1fc604fc54aae76356da1c14612af41d0, which indicate patches were applied to Grafana's source repository, but the specific patched release version has not been independently confirmed.

Exploitation Scenarios

Reconnaissance / Target Identification
Attackers first identify Grafana instances exposed to the internet. This is commonly done via Shodan search for "Grafana" in the HTTP title tag, or by probing for the /public/dashboards path. Additional fingerprints include the grafana-session cookie, the X-Content-Type-Options: nosniff header combined with specific response headers unique to Grafana, or the presence of /api/health endpoint. The attacker then checks if public dashboards are enabled — an unauthenticated request to /public/dashboards returning a 404 with a JSON body containing "Feature not enabled" indicates the feature is disabled and the instance is not targetable.

Trigger / Weaponization
Once a target with public dashboards enabled is confirmed, the attacker crafts a POST request to the public dashboard query endpoint. The endpoint URL follows the pattern POST /public/dashboards/<dashboard-uid>/panels/<panel-id>/query. The attacker generates a deeply nested JSON payload. A practical technique is to use an array with thousands of nested sub-arrays:

{"queries":[{"refId":"A","datasource":{"uid":"x"},"expr":"[[" * 5000 + "1" + "]]" * 5000}]}

This creates a payload of approximately 15KB that, when parsed recursively by Go's JSON decoder, triggers excessive stack allocations. Alternatively, a flat JSON with a 50MB string value for any parameter also works.

Payload Execution
The attacker sends the crafted request using a single HTTP POST with the body. No authentication headers are required. The expectation is that each request causes memory allocation growth of multiple gigabytes on the server through recursive JSON expansion. Sending a few dozen such requests in parallel (e.g., using a simple Python script with requests and threading) will exhaust available memory.

Post-Exploitation Impact
Once memory is exhausted, Grafana's process crashes. If deployed as a single instance, all dashboards, alerting, and data visualizations become unavailable. In a containerized deployment without memory limits, the host's OOM killer may also terminate other processes sharing the same cgroup. For high-availability setups with multiple replicas, the attacker repeats the attack against each node. The persistence of the attack is low — a simple restart of Grafana service restores functionality — but there are no persistent post-exploitation artifacts. If the attacker embeds the payload in a botnet campaign, they can maintain a low-and-slow DoS over extended periods.

Impact Assessment

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a straightforward remote attack with no prerequisites: no privileges, no user interaction, and no special conditions. The High availability impact (A:H) is the only affected component; confidentiality and integrity are not impacted.

Business Impact
For organizations running Grafana as their primary observability platform, this vulnerability can blind operations teams precisely when they need monitoring most — during an incident. SOC analysts lose visibility into infrastructure metrics, application logs, and security alerts. For Grafana instances integrated with alerting systems, a successful DoS also disables alert generation, potentially allowing other security events to go undetected.

Affected Systems
Any Grafana deployment that has the public dashboards feature enabled (controlled by the public_dashboards_enabled setting in Grafana's configuration) and is reachable from untrusted networks. Even internal-only deployments are at risk if any user on the corporate network is untrusted. The OSV fix data indicates all versions prior to the two commit hashes are affected, meaning essentially all Grafana distributions without the patch.

Blast Radius
The blast radius is limited to the Grafana process itself — the vulnerability does not allow code execution or data exfiltration. However, in multi-tenant Grafana deployments (e.g., Grafana Cloud or enterprises with dedicated instances), one instance crashing does not affect other instances. The primary expanded risk is that the DoS can be chained with other attacks: if Grafana serves as a single sign-on portal or reverse proxy for other services, its unavailability creates a cascading access failure.

Detection Guidance

Sigma Rule

title: Grafana Public Dashboard DoS - Oversized JSON Payload
id: bc9a1c2e-4f4a-4b8a-9e0e-1a2b3c4d5e6f
status: experimental
description: Detects POST requests to Grafana public dashboard query endpoint with excessively large or deeply nested JSON bodies
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: nginx
  definition: 'Grafana behind reverse proxy with access logs'
detection:
  selection_method:
    http.method: POST
    cs-method: POST
  selection_path:
    cs-uri-path|startswith: '/public/dashboards/'
    cs-uri-path|contains: '/query'
  selection_body_size:
    bytes_in|gte: 1000000  # 1MB request body
  selection_frequency:
    timeframe: 1m
    condition: selection_method and selection_path and selection_body_size
  condition: selection_frequency | count() by source.ip > 10
falsepositives:
  - Legitimate large dashboard queries by authenticated users
  - Monitoring agents fetching large data exports
level: high
tags:
  - attack.t1498
  - cve.2026.42127

YARA Rule

rule Grafana_CVE_2026_42127_JSON_Bomb
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects deeply nested JSON payloads targeting Grafana public dashboard endpoint"
        cve = "CVE-2026-42127"
        date = "2026-02-15"
        severity = "high"
    strings:
        $endpoint = "/public/dashboards/"
        $query = "/query"
        $open_brace = "{" ascii
        $deep_brace = "[[[[[[" ascii
        $quote = "\"" ascii
    condition:
        $endpoint and $query and (
            #deep_brace >= 100 or
            #open_brace >= 1000 or
            filesize > 1000000
        )
}

Suricata IDS Rule

alert http any any -> $GRAFANA_SERVERS any (msg:"Grafana Public Dashboard DoS - Large JSON Payload (CVE-2026-42127)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/public/dashboards/"; http.uri; content:"/query"; http.request_body; content:"{"; depth:1; byte_test:1,>,1000000,0,string; threshold:type both, track by_src, count 10, seconds 60; reference:cve,2026-42127; classtype:attempted-dos; sid:4212701; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where event.category == "network_traffic" and 
    network.protocol == "http" and 
    http.request.method == "POST" and 
    url.path like "/public/dashboards/*/query" and 
    http.request.bytes > 1000000 ]
  [ network where event.category == "network_traffic" and 
    network.protocol == "http" and 
    http.request.method == "POST" and 
    url.path like "/public/dashboards/*/query" ] 
| 5 occurrences

Splunk SPL Query

index=proxy OR index=webserver sourcetype=access_combined
| where method="POST" AND uri_path LIKE "%/public/dashboards/%" AND uri_path LIKE "%/query"
| eval body_size = if(isnull(bytes_in), 0, bytes_in)
| bin _time span=1m
| stats count as request_count, max(body_size) as max_body_size by src_ip, _time
| where request_count > 10 OR max_body_size > 1000000
| table _time, src_ip, request_count, max_body_size
| sort - max_body_size

Wazuh OSSEC Rule

<group name="grafana,">
  <rule id="100421" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="url" type="pcre2">/public/dashboards/.+/query</field>
    <field name="http.body_size" type="pcre2">[1-9][0-9]{6,}</field>
    <description>Grafana public dashboard DoS attempt - oversized JSON payload (CVE-2026-42127)</description>
    <group>attack.dos,</group>
    <mitre>
      <id>T1498</id>
      <name>Network Denial of Service</name>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))
The patch has been claimed by OSV with two commit hashes, but the corresponding release version number and vendor advisory have not been independently verified. Treat this as provisional until Grafana issues an official security advisory.

1. Immediate Mitigations (do these first):

• Disable public dashboards entirely if the feature is not business-critical. Set public_dashboards_enabled = false in the [features] section of grafana.ini and restart Grafana. This immediately removes the attack surface.
• If public dashboards are required, place Grafana behind a reverse proxy (Nginx, HAProxy, or cloud WAF) and enforce a client_max_body_size of 100KB. Nginx example: client_max_body_size 100k; in the server block. This blocks oversized payloads before they reach Grafana.
• Add rate limiting at the reverse proxy for the /public/dashboards/ path. Example Nginx: limit_req_zone $binary_remote_addr zone=grafana_public:10m rate=5r/s; and limit_req zone=grafana_public burst=10 nodelay;.

2. Patch/Upgrade Steps:

• Monitor Grafana's official security advisory page and the GitHub releases feed. The fix is referenced in OSV with commits 92f1fba9b4b6700328e99e97328d6639df8ddc3d and 20051fb1fc604fc54aae76356da1c14612af41d0.
• Upgrade to the patched release once confirmed. Currently, no version number has been publicly associated with these commits. Check grafana --version on your instance and compare against the next stable release after these commits.
• If you are using a containerized deployment, monitor Docker Hub for grafana/grafana image tags updated after the fix commit date.

3. Long-Term Hardening:

• Implement memory limits at the container/orchestration level. For Docker: docker run --memory="2g" --memory-swap="2g" --oom-kill-disable=false. For Kubernetes: set resources.limits.memory in the Deployment spec. This prevents a single Grafana process from exhausting host memory.
• Deploy Grafana in a high-availability configuration with at least two replicas and health checks (e.g., /api/health) so that if one replica dies from the DoS, traffic is automatically routed to a healthy instance.
• Segment network access: place Grafana public dashboards in a DMZ or behind a CDN/WAF, never directly on the internet without a filtering layer.
• Integrate the detection rules above into your SIEM (Splunk, Elastic, Wazuh) and set alerts for baseline deviation: unusually high POST request sizes or request frequencies to /public/dashboards/ endpoints.

References

1. NVD Entry for CVE-2026-42127 — https://nvd.nist.gov/vuln/detail/CVE-2026-42127 (is subject to CVE data enrichment)
2. OSV Advisory — https://osv.dev/vulnerability/CVE-2026-42127 (provides commit hash references and package affliction data)
3. Grafana Official Security Advisories — https://grafana.com/security/ (monitor this page for the official patch announcement)
4. MITRE ATT&CK Technique T1498 — Network Denial of Service — https://attack.mitre.org/techniques/T1498/
5. Mandiant M-Trends Report on DoS attacks via JSON deserialization — generic reference for CWE-770 exploitation patterns (not CVE-specific).

Threat Actor Campaign Notes:
As of this report, there is no evidence of active exploitation in the wild, and CISA KEV does not list this CVE. The EPSS score of 0.00432 (35.6th percentile) suggests the vulnerability is known but not a common attack target among threat actors. The public availability of a Nuclei template lowers the barrier for exploitation, so an increase in scanning activity targeting /public/dashboards/ endpoints with large POST bodies should be anticipated within 1-3 months. SOC teams should treat any large anomalous POST traffic to this path as a probable exploitation attempt regardless of current campaign intelligence.