Grafana Labs 3

CVE-2026-21720 is a goroutine leak in Grafana's /avatar/:hash endpoint. When a user avatar isn't cached, Grafana spawns a background goroutine to fetch it from Gravatar. That goroutine sits in a 10-slot worker queue; if it waits longer than three seconds, the HTTP handler times out and stops listening — but the goroutine keeps running and tries to send its result on an unbuffered channel with no receiver, so it blocks forever. Every request with a fresh random hash leaks one goroutine and its associated memory. Sustained traffic exhausts memory and crashes the process. Affected: Grafana 3.0.0–11.6.8, 12.0.0–12.0.7, 12.1.0–12.1.4, 12.2.0–12.2.2, and 12.3.0.

Vendor severity is HIGH / 7.5 because the CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) rewards unauthenticated network reachability and full availability impact. That math is technically correct but ignores the real world: Grafana is overwhelmingly an internal service (SSO'd dashboards for eng/SRE), the impact is *just* DoS (no confidentiality or integrity loss), and the exploit is a slow-burn memory pressure attack, not an instant crash. HIGH overstates the operational reality for the ~95% of installs behind a VPN or reverse proxy.

Why this verdict

• Impact ceiling is DoS. The CVSS vector is C:N/I:N/A:H — attacker gets a crashed dashboard, not a shell, not creds, not data. That alone caps operational severity below HIGH for most environments.
• Exposure narrows further. Grafana is predominantly an internal / VPN-gated service. The subset of instances directly reachable on the internet with the pre-auth /avatar/* path exposed is the actual target population — a minority of installs.
• Role multiplier: low. Grafana is a visualization tier — (a) low-value role: dev/test dashboards, (b) typical role: production observability UI, (c) high-value role: on-call alert rendering / unified alerting. Even in the high-value role, crash impact is *degraded visibility*, not identity or data compromise. No canonical Grafana deployment ends in fleet compromise from this bug. Floor is MEDIUM.
• Trivial mitigation. A one-line nginx limit_req or a WAF rule on /avatar/* kills the exploit outright — no patching pressure equivalent to a memory-corruption bug.
• No exploitation signal. Not on KEV, EPSS near-floor, no public exploit tooling. Attackers optimize for RCE/creds, not DoSing someone's Grafana.

Why not higher?

HIGH is reserved for bugs where the blast radius plausibly reaches a domain, fleet, tenant, or supply chain. A goroutine leak that crashes a monitoring UI does not. The vendor's 7.5 is a mechanical CVSS calculation that treats "process crash" as high impact regardless of the process's role.

Why not lower?

Not LOW because unauthenticated attackers can trigger it with zero skill, and losing observability during an active incident has real operational cost (alert blindness). Not IGNORE because internet-exposed Grafana instances (a minority but non-trivial population) are genuinely at risk of hostile DoS during opportunistic scanning.

1. Rate-limit /avatar/* at the reverse proxy — Add nginx limit_req_zone / Traefik RateLimit middleware / Cloudflare rule capping /avatar/* to a few requests per second per IP. This starves the goroutine leak before it can accumulate. No mitigation SLA for MEDIUM under noisgate — apply within the 365-day remediation window, but if the Grafana instance is internet-facing, treat this as a same-week task.
2. Verify Grafana is not internet-exposed — Confirm all Grafana ingress points require SSO / VPN / IP allowlist before hitting the app. Anonymous access to /avatar/* is what makes this exploitable pre-auth. Audit reverse proxy configs and cloud load balancer listeners this month.
3. Set memory limits + auto-restart — In Kubernetes, ensure Grafana pods have resources.limits.memory set and a liveness probe that restarts on hang. On VMs, run Grafana under systemd with MemoryMax= and Restart=always. Turns a full outage into a brief blip while you patch.
4. Alert on go_goroutines growth — Grafana exposes /metrics. A Prometheus rule alerting when go_goroutines{job="grafana"} grows monotonically over 30 min catches this bug being exploited AND catches other future goroutine leaks.
5. Patch to a +security-01 release on the 365-day remediation window — Track upgrade to 11.6.9+security-01, 12.0.8+security-01, 12.1.5+security-01, 12.2.3+security-01, or 12.3.1+security-01. Because 12.0.x is EOL, plan a version-line migration to 12.3.x or the current LTS at the same time — noisgate remediation SLA for MEDIUM is ≤ 365 days.

Run on the Grafana host (or any host with SSH access to it) as an unprivileged user. Invoke as ./check_grafana_cve_2026_21720.sh http://localhost:3000 — no root needed. Script queries the Grafana health endpoint for its version and compares against the fixed set.

#!/usr/bin/env bash
# check_grafana_cve_2026_21720.sh
# Detects CVE-2026-21720 (Grafana avatar goroutine-leak DoS)
# Usage: ./check_grafana_cve_2026_21720.sh <grafana_base_url>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
BASE="${1:-http://localhost:3000}"

JSON=$(curl -fsS --max-time 5 "${BASE%/}/api/health" 2>/dev/null) || {
  echo "UNKNOWN: could not reach ${BASE}/api/health"
  exit 2
}

VER=$(echo "$JSON" | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse version from /api/health"
  exit 2
fi

echo "Detected Grafana version: $VER"

# Strip +security-01 suffix marker before numeric compare
CORE=$(echo "$VER" | cut -d+ -f1)
SUFFIX=$(echo "$VER" | grep -o '+security-[0-9]*' || true)

MAJ=$(echo "$CORE" | cut -d. -f1)
MIN=$(echo "$CORE" | cut -d. -f2)
PAT=$(echo "$CORE" | cut -d. -f3)

vuln() { echo "VULNERABLE: $VER is affected by CVE-2026-21720"; exit 1; }
safe() { echo "PATCHED: $VER contains the CVE-2026-21720 fix";   exit 0; }

# Fixed floors per line:
#   11.6.9+security-01, 12.0.8+security-01, 12.1.5+security-01,
#   12.2.3+security-01, 12.3.1+security-01, >= 12.4.0
case "$MAJ.$MIN" in
  11.6)
    if [ "$PAT" -gt 9 ] || { [ "$PAT" -eq 9 ] && [ -n "$SUFFIX" ]; }; then safe; else vuln; fi ;;
  12.0)
    if [ "$PAT" -gt 8 ] || { [ "$PAT" -eq 8 ] && [ -n "$SUFFIX" ]; }; then safe; else vuln; fi ;;
  12.1)
    if [ "$PAT" -gt 5 ] || { [ "$PAT" -eq 5 ] && [ -n "$SUFFIX" ]; }; then safe; else vuln; fi ;;
  12.2)
    if [ "$PAT" -gt 3 ] || { [ "$PAT" -eq 3 ] && [ -n "$SUFFIX" ]; }; then safe; else vuln; fi ;;
  12.3)
    if [ "$PAT" -gt 1 ] || { [ "$PAT" -eq 1 ] && [ -n "$SUFFIX" ]; }; then safe; else vuln; fi ;;
  *)
    if [ "$MAJ" -gt 12 ] || { [ "$MAJ" -eq 12 ] && [ "$MIN" -ge 4 ]; }; then safe; fi
    if [ "$MAJ" -lt 11 ] || { [ "$MAJ" -eq 11 ] && [ "$MIN" -lt 6 ]; }; then vuln; fi
    echo "UNKNOWN: version $VER is outside the known matrix — verify manually"
    exit 2
    ;;
esac

Sources

1. Tenable Plugin 297198
2. Grafana Labs Security Advisories
3. Grafana Security Release Blog (Jan 2026)
4. CVE Details — Grafana
5. Grafana CVE curated list (kh4sh3i)
6. Canadian Centre for Cyber Security — Grafana AV26-285
7. OpenCVE — Grafana product page
8. Grafana Labs — version list