Database/Control plane, storage & DevOps
Grafana: unbounded request body on the Prometheus rule conversion API crashes the server via out-of-memory
Impact
The Prometheus rule conversion endpoints accept a request body with no size limit, so an authenticated user can force unbounded memory allocation and take the Grafana process down with an out-of-memory kill. Availability only - no data is exposed or altered. It matters because Grafana is usually the single pane an operations team watches: losing it does not stop the GPU fleet, but it does leave the people on call without dashboards or the alert UI until the process comes back, and a user who can send the request can send it again. Any authenticated account is enough, which on a multi-tenant or widely shared instance is a large set of people.
Who can reach it
Any authenticated Grafana user able to reach the rule conversion API over the network. No elevated role is stated as required.
What to do
Upgrade to the fixed Grafana versions in the vendor advisory and restart the server. Until then, put a request body size limit in front of Grafana at the reverse proxy and make sure the Grafana process has a memory limit and automatic restart configured, so an OOM is a blip rather than an outage someone has to notice first.
References
Related entries
- lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
- Apache Airflow: Bulk Variables API skips key-based redaction, returning JSON variable secrets in cleartextCVE-2026-48828 · Apache Airflow (Bulk Variables API, secrets masker key-based redaction)Medium
- Apache Airflow: Config API exposes secrets-backend kwargs overrides unmasked, leaking Vault credentialsCVE-2026-48892 · Apache Airflow (Config API, per-key secrets-backend environment overrides)Medium
- Apache Airflow: Dag source endpoint returns the whole file, exposing co-located Dags the caller cannot readCVE-2026-49296 · Apache Airflow (Dag source endpoint, GET /api/v2/dagSources/{dag_id})Medium
- Apache Airflow: task-instance API returns deferred trigger kwargs unmasked, exposing secrets passed to triggersCVE-2026-49487 · Apache Airflow (REST API task-instance endpoints, deferred trigger kwargs)Medium
- Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.