Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image

CVE-2026-21720 is an unauthenticated denial-of-service bug in Grafana’s avatar handling. On vulnerable builds, every uncached GET /avatar/:hash request kicks off a Gravatar refresh goroutine; when that refresh sits in the 10-slot worker queue for more than three seconds, the request handler times out, stops listening, and the goroutine can block forever trying to send on an unbuffered channel. Vendor-listed affected ranges are >=3.0.0 <11.6.9+security-01, >=12.0.0 <12.0.8+security-01, >=12.1.0 <12.1.5+security-01, >=12.2.0 <12.2.3+security-01, and 12.3.0.

The vendor’s 7.5/HIGH score is technically defensible in a vacuum because the bug is remote, unauthenticated, and availability-impacting. In real enterprise operations, though, this is still *only* a Grafana process crash path, it needs sustained cache-miss traffic rather than a single packet win, and the most exposed population is the subset of Grafana instances reachable to attackers at all. That combination pushes it down a bucket for most fleets.

Why this verdict

• Start from 7.5/HIGH: vendor scoring is reasonable because the bug is remote, unauthenticated, and can crash the service.
• Downward adjustment for attacker position: the attacker still needs network reachability to the Grafana web app, and a large share of enterprise Grafana is internal-only or gated behind VPN/SSO/reverse proxy policy.
• Downward adjustment for exploit friction: this is not a one-request kill; the attacker must sustain randomized cache-miss traffic long enough to keep the 10-slot queue timing out and leak goroutines.
• Downward adjustment for blast radius: impact is usually limited to Grafana service availability, not code execution, data theft, or compromise of monitored assets.
• No upward pressure from threat intel: no KEV listing, no solid in-the-wild reporting, and a very low EPSS keep this out of the urgent bucket.

Why not higher?

There is no evidence here of code execution, privilege gain, tenant escape, or durable compromise. The chain also assumes direct reachability to Grafana plus sustained traffic pressure, which is a meaningful practical brake compared with truly urgent pre-auth bugs.

Why not lower?

It still deserves attention because the endpoint is unauthenticated and the exploit concept is simple enough for any attacker with HTTP flood capability. If you run Grafana on the public Internet or it backs operational visibility for responders, the availability hit can be painful even without deeper compromise.

1. Restrict Grafana reachability — Put Grafana behind VPN, zero-trust access, IP allowlists, or an authenticated reverse proxy so unauthenticated Internet users cannot hit /avatar/* at all. For a MEDIUM verdict there is no noisgate mitigation SLA, but do this immediately on any Internet-facing instance because it is the cleanest exposure reducer.
2. Disable Gravatar — Set disable_gravatar = true in grafana.ini to remove the vulnerable avatar refresh path from normal operation. There is no noisgate mitigation SLA for MEDIUM; use this as low-risk containment while you work the patch into the remediation window.
3. Rate-limit /avatar/ — Apply per-IP and burst limits at the CDN, WAF, ingress controller, or reverse proxy specifically for /avatar/ requests so random-hash floods cannot keep the refresh queue saturated. This is especially useful where Grafana must remain externally reachable.
4. Alert on goroutine and memory growth — Monitor Grafana process RSS, restart counts, OOM events, and Go runtime metrics like go_goroutines so you detect abuse before the process falls over. This does not fix the bug, but it shortens outage duration and improves confidence that the control path is working.

Run this on the Grafana host with a shell that can execute grafana-server -v, or with access to the local package database. Invoke it as bash check_cve_2026_21720.sh from the server; no root is required unless your package manager metadata is restricted. It performs a version-based check and prints exactly VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_cve_2026_21720.sh
# Version-based verification for Grafana CVE-2026-21720
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

normalize_version() {
  # Strip leading v and Grafana security suffixes for branch comparisons.
  echo "$1" | sed -E 's/^v//; s/\+security-[0-9]+$//'
}

version_lt() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

version_ge() {
  ! version_lt "$1" "$2"
}

get_version() {
  local v=""

  if command -v grafana-server >/dev/null 2>&1; then
    v=$(grafana-server -v 2>/dev/null | sed -nE 's/.*Version ([^ ]+).*/\1/p' | head -n1)
  fi

  if [ -z "$v" ] && command -v rpm >/dev/null 2>&1; then
    v=$(rpm -q --qf '%{VERSION}\n' grafana 2>/dev/null | head -n1)
    [ -z "$v" ] && v=$(rpm -q --qf '%{VERSION}\n' grafana-enterprise 2>/dev/null | head -n1)
  fi

  if [ -z "$v" ] && command -v dpkg-query >/dev/null 2>&1; then
    v=$(dpkg-query -W -f='${Version}\n' grafana 2>/dev/null | sed 's/-.*//' | head -n1)
    [ -z "$v" ] && v=$(dpkg-query -W -f='${Version}\n' grafana-enterprise 2>/dev/null | sed 's/-.*//' | head -n1)
  fi

  if [ -z "$v" ]; then
    return 1
  fi

  normalize_version "$v"
  return 0
}

is_vulnerable() {
  local v="$1"

  # Affected ranges from advisory, normalized for comparison.
  if version_ge "$v" "3.0.0" && version_lt "$v" "11.6.9"; then return 0; fi
  if version_ge "$v" "12.0.0" && version_lt "$v" "12.0.8"; then return 0; fi
  if version_ge "$v" "12.1.0" && version_lt "$v" "12.1.5"; then return 0; fi
  if version_ge "$v" "12.2.0" && version_lt "$v" "12.2.3"; then return 0; fi
  if [ "$v" = "12.3.0" ]; then return 0; fi

  return 1
}

main() {
  local version=""
  if ! version=$(get_version); then
    echo "UNKNOWN"
    exit 2
  fi

  if is_vulnerable "$version"; then
    echo "VULNERABLE"
    exit 1
  fi

  # Patched branches per Grafana advisory / release model.
  if { version_ge "$version" "11.6.9" && version_lt "$version" "12.0.0"; } || \
     { version_ge "$version" "12.0.8" && version_lt "$version" "12.1.0"; } || \
     { version_ge "$version" "12.1.5" && version_lt "$version" "12.2.0"; } || \
     { version_ge "$version" "12.2.3" && version_lt "$version" "12.3.0"; } || \
     version_ge "$version" "12.3.1"; then
    echo "PATCHED"
    exit 0
  fi

  echo "UNKNOWN"
  exit 2
}

main "$@"

Sources

1. Grafana advisory for CVE-2026-21720
2. Grafana security advisories index
3. NVD entry for CVE-2026-21720
4. Grafana configuration docs (`disable_gravatar`)
5. Grafana upgrade guidance for `+security-01` releases
6. Tenable Nessus plugin 297198
7. CISA Known Exploited Vulnerabilities catalog
8. Grafana 12.3.1 download page