Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 1...

Tenable plugin 329319 bundles four Grafana CVEs disclosed on June 9, 2026. CVE-2026-42127 and CVE-2026-33382 (both CVSS 7.5 High) let unauthenticated attackers crash Grafana by sending oversized JSON payloads to the public dashboard query endpoint and several other API endpoints that lack request-body size limits — Grafana reads the entire body into memory, the Go runtime balloons, and the OS OOM-killer finishes the job. CVE-2026-8609 (CVSS 5.3 Medium) achieves the same crash by hammering the OAuth login route with unique parameter values, causing unbounded goroutine memory growth. CVE-2026-10601 (CVSS 5.4 Medium) is the odd one out: a path traversal in the Tempo and Loki data source plugins that lets an authenticated Viewer reach unintended backend endpoints, potentially leaking data source credentials or triggering backend administrative actions. All four are fixed in Grafana 11.6.15, 12.2.9, 12.3.7, 12.4.4, and 13.0.2+. Grafana 12.0.x is end-of-life and received no patch.

Grafana Labs rates the two memory-exhaustion DoS CVEs at HIGH (7.5), while Tenable's composite plugin severity lands at MEDIUM with a VPR of just 3.0 (23rd percentile). The MEDIUM composite is closer to reality. The individual 7.5 scores are mechanically correct per CVSS — network-accessible, no-auth, low-complexity, high availability impact — but they ignore that the target is a monitoring dashboard, not a domain controller or data store. Crashing Grafana costs you visibility, not confidentiality or integrity. Modern deployments auto-restart via systemd or Kubernetes liveness probes in seconds, and a single client_max_body_size directive on your reverse proxy eliminates the entire DoS attack surface. The path traversal (CVE-2026-10601) is the more interesting bug from a security perspective, but its 5.4 CVSS, authentication prerequisite, and dependence on Tempo/Loki backend configuration keep it from elevating the bundle.

1. Enforce request body size limits on your reverse proxy — Add client_max_body_size 1m; in nginx, LimitRequestBody 1048576 in Apache, or equivalent payload-size policy in your ALB/CDN for the Grafana vhost. This neutralizes CVE-2026-42127 and CVE-2026-33382 completely by preventing oversized payloads from ever reaching the Grafana process. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day noisgate remediation SLA window. That said, this is a 5-minute config change and should be standard infrastructure hygiene.
2. Rate-limit OAuth login endpoints — Configure your reverse proxy or WAF to rate-limit requests to /login/generic_oauth and related OAuth callback routes to ≤10 req/s per source IP. This mitigates CVE-2026-8609's unbounded memory growth from repeated unique-state-parameter calls. Cloudflare rate-limiting rules, AWS WAF rate-based rules, or nginx limit_req all work. Deploy within your normal change window — no mitigation SLA for MEDIUM.
3. Disable public dashboards on instances that don't need them — Set [feature_toggles] publicDashboards = false in grafana.ini on any Grafana instance not actively serving anonymous public dashboards. This eliminates the CVE-2026-42127 attack surface entirely. Audit your fleet — most internal monitoring instances have no business reason for public dashboard access.
4. Audit Viewer-role access to Tempo/Loki data sources — For CVE-2026-10601, review which users or service accounts have Viewer permissions on folders and dashboards backed by Tempo or Loki data sources. Restrict to need-to-know. If your Tempo/Loki backends store credentials or expose admin endpoints reachable via path traversal, add network segmentation between Grafana's data source proxy and those backends.
5. Upgrade Grafana to fixed versions within the 365-day remediation window — Patch to Grafana 11.6.15, 12.2.9, 12.3.7, 12.4.4, or 13.0.2+. Per the noisgate remediation SLA for MEDIUM severity, complete this within 365 days. Grafana 12.0.x is EOL with no patch — those instances must be upgraded to at least 12.2.9. Schedule this in your next quarterly patch cycle.

Run on each Grafana host, or from any auditor workstation that can reach the Grafana HTTP API. No special privileges needed — the script queries the unauthenticated /api/health endpoint, falling back to the grafana-server binary if the API is unreachable. Usage: bash check_grafana_329319.sh http://grafana.internal:3000

#!/usr/bin/env bash
# noisgate verification — tenable:329319
# CVE-2026-42127 / CVE-2026-33382 / CVE-2026-8609 / CVE-2026-10601
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
set -euo pipefail

GRAFANA_URL="${1:-http://localhost:3000}"
VERSION=""

# --- Method 1: unauthenticated API health endpoint ---
if command -v curl &>/dev/null; then
  VERSION=$(curl -sf --max-time 5 "${GRAFANA_URL}/api/health" 2>/dev/null \
    | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

# --- Method 2: grafana-server binary on the local host ---
if [ -z "$VERSION" ]; then
  for BIN in grafana-server /usr/sbin/grafana-server /usr/share/grafana/bin/grafana; do
    if command -v "$BIN" &>/dev/null 2>&1 || [ -x "$BIN" 2>/dev/null ]; then
      VERSION=$("$BIN" -v 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
      [ -n "$VERSION" ] && break
    fi
  done
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not determine Grafana version via ${GRAFANA_URL}/api/health or local binary"
  exit 2
fi

echo "Detected Grafana version: ${VERSION}"
IFS='.' read -r MAJ MIN PAT <<< "$VERSION"
VULN=0

# Affected ranges:
#   11.6.0  – 11.6.14  → fixed 11.6.15
#   12.0.x  – 12.1.x   → EOL / no patch (vulnerable)
#   12.2.0  – 12.2.8   → fixed 12.2.9
#   12.3.0  – 12.3.6   → fixed 12.3.7
#   12.4.0  – 12.4.3   → fixed 12.4.4
#   13.0.0  – 13.0.1   → fixed 13.0.2

if   [[ $MAJ -eq 11 && $MIN -eq 6 && $PAT -lt 15 ]]; then VULN=1
elif [[ $MAJ -eq 12 && ( $MIN -eq 0 || $MIN -eq 1 ) ]]; then VULN=1  # EOL, no fix
elif [[ $MAJ -eq 12 && $MIN -eq 2 && $PAT -lt 9 ]]; then VULN=1
elif [[ $MAJ -eq 12 && $MIN -eq 3 && $PAT -lt 7 ]]; then VULN=1
elif [[ $MAJ -eq 12 && $MIN -eq 4 && $PAT -lt 4 ]]; then VULN=1
elif [[ $MAJ -eq 13 && $MIN -eq 0 && $PAT -lt 2 ]]; then VULN=1
fi

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE - Grafana ${VERSION} is affected by CVE-2026-42127 / 33382 / 8609 / 10601"
  echo "Upgrade to: 11.6.15 | 12.2.9 | 12.3.7 | 12.4.4 | 13.0.2+"
  exit 1
else
  echo "PATCHED - Grafana ${VERSION} is not in any affected range"
  exit 0
fi

1. Grafana Advisory — CVE-2026-42127 (Pre-auth DoS via public dashboard query)
2. Grafana Advisory — CVE-2026-33382 (DoS via oversized request bodies)
3. Grafana Advisory — CVE-2026-8609 (OAuth login unbounded memory growth)
4. Grafana Advisory — CVE-2026-10601 (Tempo/Loki path traversal)
5. Tenable Plugin 329319 — Grafana Multiple Vulnerabilities
6. Grafana Feature Toggles Documentation (sqlExpressions GA status)
7. BleepingComputer — Grafana Shodan Exposure Data (128K+ instances)
8. Grafana Security Advisories Index