Read the docs
Red Hat Security Advisory

RHSA-2026:54178

grafana security, bug fix, and enhancement update

Released 2026-08-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2026-30467 CVE-2026-42127 · GHSA-3w66-95m3-8jxg

Pre-authentication denial of service in the public dashboard query endpoint

Priority LOW 39

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-06-22 Partial fix · 1.9.2-0.20260616075434-82ef13993059 CWE-400
TI-2026-25780 CVE-2026-33382 · GHSA-xcrv-g5fh-9wx2

Denial of service via unbounded request body size

Priority LOW 39

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2026-07-10 Partial fix CWE-400
TI-2026-07565 CVE-2026-8609 · GHSA-j7jj-549c-j492

Pre-authentication denial of service via the OAuth login route

Priority LOW 39

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2026-07-10 Partial fix CWE-400
TI-2026-25775 CVE-2026-33376 · GHSA-3r2p-7499-27q3

Auth Proxy IPv6 whitelist bypass

Priority LOW 34

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00282 Published 2026-05-13 Partial fix · 11.6.14+security-04, 12.2.8+security-04 +3 CWE-1188