The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1633:24 advisory.

    * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads     (CVE-2026-42127)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1616:23 advisory.

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
      * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads     (CVE-2026-42127)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-54184 advisory.

    - fix CVE-2026-42127: cap request body size and validate public dashboard access

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54243 advisory.

    - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520]
    - Resolves RHEL-219393: CVE-2026-42127

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:

  - The public dashboard query endpoint does not limit request body size before processing, allowing     unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.
    This can lead to denial of service through memory exhaustion. (CVE-2026-42127)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing     unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of     service). (CVE-2026-8609)

  - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body     before processing it. An attacker can send very large payloads that force excessive memory allocation,     potentially exhausting memory and causing a denial of service. (CVE-2026-33382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0562 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-42127:
    The public dashboard query endpoint does not limit request body size before processing, allowing     unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON     payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or     authentication is required to exploit this vulnerability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The public dashboard query endpoint does not limit request body size before processing, allowing     unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON     payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or     authentication is required to exploit this vulnerability. (CVE-2026-42127)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's
    XYZ tile layer via a template variable. The script then executes in the browser of any user who views the
    affected dashboard (stored cross-site scripting). (CVE-2026-9029)

  - A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious
    field name that executes as a script in the browser of any user who views the dashboard (stored cross-site
    scripting). (CVE-2026-8595)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing
    unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of
    service). (CVE-2026-8609)

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source
    plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data
    source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

ID	Name	Product	Family	Type	Severity
339116	MiracleLinux 9 : grafana-10.2.6-23.el9_8.1 (AXSA:2026-1633:24)	Nessus	Miracle Linux Local Security Checks	Local	high
339029	MiracleLinux 8 : grafana-9.2.10-32.el8_10.1 (AXSA:2026-1616:23)	Nessus	Miracle Linux Local Security Checks	Local	high
335468	Oracle Linux 9 : grafana (ELSA-2026-54184)	Nessus	Oracle Linux Local Security Checks	Local	high
335237	Oracle Linux 8 : grafana (ELSA-2026-54243)	Nessus	Oracle Linux Local Security Checks	Local	high
329319	Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
325850	TencentOS Server 4: grafana (TSSA-2026:0562)	Nessus	Tencent Local Security Checks	Local	high
322237	Linux Distros Unpatched Vulnerability : CVE-2026-42127	Nessus	Misc.	Local	high
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-42127

high

Tenable Plugins

high

high

high

high

medium

high

high

medium

medium