CVE-2026-42127
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion.
Risk Assessment
An unauthenticated attacker can exhaust server memory, causing service unavailability for legitimate users and potential downtime.
Recommendation
Implement request body size limits for the public dashboard endpoint and consider adding limits on the depth and size of processed JSON objects.
Other vulnerabilities in Dashboard
See all- CVE-2026-12593High
An internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) failed to enforce sufficient permissions when creating an API token for another user. An attacker knowing the login name of a privileged internal user and authenticated via OAuth/OIDC could forge a token creation request on their behalf.
- CVE-2026-33377High
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to escalate privilege.
Original NVD description (English source)
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.