Database/Control plane, storage & DevOps
Grafana Elasticsearch data source: extreme time range makes the server allocate memory until it dies
Impact
On an Elasticsearch data source with a time-based index pattern, Grafana generates one index name for every interval in the query time range, with no upper limit. A user who can query the data source (Viewer in a default configuration) can send one small query with an extreme time range and make the server allocate memory until it is killed. This happens before any request reaches Elasticsearch, so it works whether or not the cluster is reachable. The result is a low-privilege way to take down the monitoring and logging view of the fleet.
Who can reach it
An authenticated user with permission to query the Elasticsearch data source (Viewer by default), over the network.
What to do
Upgrade Grafana to a fixed release listed in the Grafana advisory and restart the Grafana server. The record names no fixed version. Data sources that use a static index name are not affected. Until you upgrade, restrict query permission on time-pattern Elasticsearch data sources.
References
Related entries
- Ansible automation-controller: REST filter oracle on workflow artifacts leaks no_log secrets across organizationsCVE-2026-84720 · Red Hat Ansible Automation Platform automation-controller (REST filter on WorkflowJobNode.ancestor_artifacts)Medium
- Airflow Akeyless provider: path-shaped Variable key bypasses the team-scope guard on secret lookupCVE-2026-86465 · Apache Airflow Akeyless provider (secrets backend, team-scope guard)Medium
- Grafana: Viewer-level user crashes the server with a recursive math expressionCVE-2026-88858 · Grafana (server-side expressions math evaluator)Medium
- Jenkins Bitbucket Push and Pull Request Plugin: webhook payload can redirect credentialed requestsCVE-2026-92139 · Jenkins Bitbucket Push and Pull Request Plugin (webhook-supplied URLs)Medium
- Airflow HashiCorp provider: path-shaped Variable key crosses team scope in the Vault secrets backendCVE-2026-97636 · Apache Airflow HashiCorp provider (Vault secrets backend, team-scoped variable lookup)Medium
- Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL andNCVD-2024-010-ceph-python-bindings-imap4-ssl-s · Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.