Skip to content
Fencer Intel
medium 6.5

CVE-2026-81843 json

Memory exhaustion denial of service in Elasticsearch data source index patterns

published 2d ago modified 2d ago also EUVD-2026-124572

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

Grafana is an open-source platform for monitoring and observability.

When an Elasticsearch data source is configured with a time-based index pattern, Grafana generated one index name for every interval in the requested query time range without any upper limit. A user with permission to query the data source, which includes users holding only the Viewer role in a default configuration, could submit a single small query with an extreme time range and cause the server to allocate memory until it was terminated. The allocation occurred before any request was sent to Elasticsearch, so the condition applied whether or not the Elasticsearch cluster was reachable.

Data sources configured with a static index name are not affected.

Patch / fix

  • Grafana Grafana OSS 12.4.15
  • Grafana Elasticsearch Datasource 12.9.6
  • Grafana Grafana Enterprise 12.4.15

Is CVE-2026-81843 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Grafana Grafana OSS
  • Grafana Elasticsearch Datasource
  • Grafana Grafana Enterprise

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.