Grafana 8.0.0 < 11.6.14 / 12.0.0 < 12.1.10 / 12.2.0 < 12.2.8 /...

CVE-2026-27879 is an uncontrolled resource consumption flaw in Grafana's resample query transformation engine. An authenticated user (Viewer role or higher) can craft a resample query with parameters that trigger unbounded memory allocation, causing the Grafana server process to crash with an out-of-memory (OOM) condition. The impact is availability-only — no data leaks, no code execution, no lateral movement. Affected versions span an enormous range: every Grafana release from 8.0.0 through 12.4.1, with fixes landing in 11.6.14, 12.1.10, 12.2.8, 12.3.6, and 12.4.2.

The vendor's MEDIUM / 6.5 rating is broadly fair but slightly generous for most enterprise deployments. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly prices in the authentication requirement and availability-only impact, but it can't model the fact that Grafana processes almost universally auto-restart under systemd or Kubernetes, making the outage transient (seconds to low minutes). There is no public proof-of-concept, no known exploitation in the wild, EPSS sits at 0.376% (31st percentile), and this CVE is absent from the CISA KEV catalog. The real-world risk is a brief dashboard blackout, not a persistent outage.

1. Set memory cgroup limits on the Grafana process — Configure MemoryMax= in systemd or container resource limits in Kubernetes (e.g., resources.limits.memory: 2Gi). This causes the OOM-kill to fire faster and the auto-restart to recover in seconds rather than letting the host swap-thrash. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window, but this control is cheap and should be standard anyway.
2. Deploy Grafana in HA mode with ≥2 replicas — Running multiple Grafana pods behind a load balancer ensures a single-instance OOM crash produces zero user-visible downtime. This is the single most effective compensating control and eliminates the attack's impact entirely.
3. Rate-limit the /api/ds/query endpoint — Use a reverse proxy (nginx, Envoy, or cloud WAF) to throttle query submissions per user session. A limit of 10–20 req/s per user is generous for legitimate use and prevents rapid-fire OOM attempts.
4. Restrict Viewer account provisioning and disable anonymous access — Audit Grafana's [auth.anonymous] and [auth] configuration blocks. Ensure enabled = false for anonymous access (default since Grafana 10). Remove stale Viewer accounts. Tighter access control reduces the pool of potential attackers.
5. Upgrade to a fixed Grafana version — Deploy 11.6.14, 12.1.10, 12.2.8, 12.3.6, or 12.4.2+ within the noisgate 365-day remediation SLA for MEDIUM-severity findings. Prioritize internet-facing instances.

Run this script on the Grafana server (or any host that can reach the Grafana HTTP endpoint) as an unprivileged user. Invoke: bash check_cve_2026_27879.sh https://grafana.example.com. It queries the Grafana /api/health endpoint to extract the running version and compares it against the known-fixed versions. No authentication required for the health endpoint.

#!/usr/bin/env bash
# check_cve_2026_27879.sh — Detect CVE-2026-27879 (Grafana resample OOM DoS)
# Usage: bash check_cve_2026_27879.sh <GRAFANA_URL>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:-}"
if [[ -z "$GRAFANA_URL" ]]; then
  echo "Usage: $0 <GRAFANA_URL>"
  exit 2
fi

# Strip trailing slash
GRAFANA_URL="${GRAFANA_URL%/}"

# Fetch version from /api/health
RESPONSE=$(curl -s --max-time 10 "${GRAFANA_URL}/api/health" 2>/dev/null) || {
  echo "UNKNOWN — could not reach ${GRAFANA_URL}/api/health"
  exit 2
}

VERSION=$(echo "$RESPONSE" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null) || {
  echo "UNKNOWN — could not parse version from health endpoint"
  exit 2
}

echo "Detected Grafana version: $VERSION"

# Version comparison helper
ver_cmp() {
  printf '%s\n%s' "$1" "$2" | sort -t. -k1,1n -k2,2n -k3,3n | head -n1
}

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

VULNERABLE=0

# Affected: 8.0.0 <= v < 11.6.14 (i.e., major 8-10 all vulnerable; 11.x < 11.6.14)
if [[ $MAJOR -ge 8 && $MAJOR -le 10 ]]; then
  VULNERABLE=1
elif [[ $MAJOR -eq 11 ]]; then
  if [[ $(ver_cmp "$VERSION" "11.6.14") == "$VERSION" && "$VERSION" != "11.6.14" ]]; then
    VULNERABLE=1
  fi
# Affected: 12.0.0 <= v < 12.1.10
elif [[ $MAJOR -eq 12 && $MINOR -eq 0 ]]; then
  VULNERABLE=1
elif [[ $MAJOR -eq 12 && $MINOR -eq 1 ]]; then
  if [[ $(ver_cmp "$VERSION" "12.1.10") == "$VERSION" && "$VERSION" != "12.1.10" ]]; then
    VULNERABLE=1
  fi
# Affected: 12.2.0 <= v < 12.2.8
elif [[ $MAJOR -eq 12 && $MINOR -eq 2 ]]; then
  if [[ $(ver_cmp "$VERSION" "12.2.8") == "$VERSION" && "$VERSION" != "12.2.8" ]]; then
    VULNERABLE=1
  fi
# Affected: 12.3.0 <= v < 12.3.6
elif [[ $MAJOR -eq 12 && $MINOR -eq 3 ]]; then
  if [[ $(ver_cmp "$VERSION" "12.3.6") == "$VERSION" && "$VERSION" != "12.3.6" ]]; then
    VULNERABLE=1
  fi
# Affected: 12.4.0 <= v < 12.4.2
elif [[ $MAJOR -eq 12 && $MINOR -eq 4 ]]; then
  if [[ $(ver_cmp "$VERSION" "12.4.2") == "$VERSION" && "$VERSION" != "12.4.2" ]]; then
    VULNERABLE=1
  fi
fi

if [[ $VULNERABLE -eq 1 ]]; then
  echo "VULNERABLE — Grafana $VERSION is affected by CVE-2026-27879"
  exit 1
else
  echo "PATCHED — Grafana $VERSION is not affected by CVE-2026-27879"
  exit 0
fi

1. Grafana Security Advisory — CVE-2026-27879
2. Tenable Plugin 304688
3. GitHub Advisory GHSA-4368-7mjc-5763
4. NVD — CVE-2026-27879
5. Ubuntu Security Tracker — CVE-2026-27879
6. Red Hat Errata RHSA-2026:62407
7. SentinelOne Vulnerability DB — CVE-2026-27879