Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Elasticsearch Datasource by Grafana
CVE-2026-81843 (GCVE-0-2026-81843)
Vulnerability from nvd – Published: 2026-11-12 17:40 – Updated: 2026-11-12 17:40
VLAI
EPSS
VEX
Title
Memory exhaustion denial of service in Elasticsearch data source index patterns
Summary
Grafana is an open-source platform for monitoring and observability.
When an Elasticsearch data source is configured with a time-based index pattern, Grafana
generated one index name for every interval in the requested query time range without any upper
limit. A user with permission to query the data source, which includes users holding only the
Viewer role in a default configuration, could submit a single small query with an extreme time
range and cause the server to allocate memory until it was terminated. The allocation occurred
before any request was sent to Elasticsearch, so the condition applied whether or not the
Elasticsearch cluster was reachable.
Data sources configured with a static index name are not affected.
Severity
6.5 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
11.6.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , < 12.4.15 (semver) |
|
| Grafana | Elasticsearch Datasource |
Affected:
12.4.2 , < 12.9.6
(semver)
|
|
| Grafana | Grafana Enterprise |
Affected:
11.6.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , < 12.4.15 (semver) |
Date Public
2026-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Elasticsearch Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.9.6",
"status": "affected",
"version": "12.4.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "khanmarshal (Researcher)"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana is an open-source platform for monitoring and observability.\n\nWhen an Elasticsearch data source is configured with a time-based index pattern, Grafana\ngenerated one index name for every interval in the requested query time range without any upper\nlimit. A user with permission to query the data source, which includes users holding only the\nViewer role in a default configuration, could submit a single small query with an extreme time\nrange and cause the server to allocate memory until it was terminated. The allocation occurred\nbefore any request was sent to Elasticsearch, so the condition applied whether or not the\nElasticsearch cluster was reachable.\n\nData sources configured with a static index name are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:40:38.085Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-81843"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Memory exhaustion denial of service in Elasticsearch data source index patterns"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-81843",
"datePublished": "2026-11-12T17:40:38.085Z",
"dateReserved": "2026-08-27T15:50:09.094Z",
"dateUpdated": "2026-11-12T17:40:38.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106475 (GCVE-0-2026-106475)
Vulnerability from nvd – Published: 2026-11-12 17:40 – Updated: 2026-11-12 17:40
VLAI
EPSS
VEX
Title
Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials
Summary
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
Severity
7.1 (High)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Elasticsearch Datasource |
Affected:
12.4.2 , < 12.9.6
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
10.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
10.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) |
Date Public
2026-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Elasticsearch Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.9.6",
"status": "affected",
"version": "12.4.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source\u0027s own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:40:38.141Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-106475"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source\u0027s credentials"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-106475",
"datePublished": "2026-11-12T17:40:38.141Z",
"dateReserved": "2026-10-06T17:52:05.181Z",
"dateUpdated": "2026-11-12T17:40:38.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106475 (GCVE-0-2026-106475)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:40 – Updated: 2026-11-12 17:40
VLAI
EPSS
VEX
Title
Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials
Summary
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
Severity
7.1 (High)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Elasticsearch Datasource |
Affected:
12.4.2 , < 12.9.6
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
10.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
10.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) |
Date Public
2026-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Elasticsearch Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.9.6",
"status": "affected",
"version": "12.4.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source\u0027s own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:40:38.141Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-106475"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source\u0027s credentials"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-106475",
"datePublished": "2026-11-12T17:40:38.141Z",
"dateReserved": "2026-10-06T17:52:05.181Z",
"dateUpdated": "2026-11-12T17:40:38.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81843 (GCVE-0-2026-81843)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:40 – Updated: 2026-11-12 17:40
VLAI
EPSS
VEX
Title
Memory exhaustion denial of service in Elasticsearch data source index patterns
Summary
Grafana is an open-source platform for monitoring and observability.
When an Elasticsearch data source is configured with a time-based index pattern, Grafana
generated one index name for every interval in the requested query time range without any upper
limit. A user with permission to query the data source, which includes users holding only the
Viewer role in a default configuration, could submit a single small query with an extreme time
range and cause the server to allocate memory until it was terminated. The allocation occurred
before any request was sent to Elasticsearch, so the condition applied whether or not the
Elasticsearch cluster was reachable.
Data sources configured with a static index name are not affected.
Severity
6.5 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
11.6.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , < 12.4.15 (semver) |
|
| Grafana | Elasticsearch Datasource |
Affected:
12.4.2 , < 12.9.6
(semver)
|
|
| Grafana | Grafana Enterprise |
Affected:
11.6.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , < 12.4.15 (semver) |
Date Public
2026-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Elasticsearch Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.9.6",
"status": "affected",
"version": "12.4.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "khanmarshal (Researcher)"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana is an open-source platform for monitoring and observability.\n\nWhen an Elasticsearch data source is configured with a time-based index pattern, Grafana\ngenerated one index name for every interval in the requested query time range without any upper\nlimit. A user with permission to query the data source, which includes users holding only the\nViewer role in a default configuration, could submit a single small query with an extreme time\nrange and cause the server to allocate memory until it was terminated. The allocation occurred\nbefore any request was sent to Elasticsearch, so the condition applied whether or not the\nElasticsearch cluster was reachable.\n\nData sources configured with a static index name are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:40:38.085Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-81843"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Memory exhaustion denial of service in Elasticsearch data source index patterns"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-81843",
"datePublished": "2026-11-12T17:40:38.085Z",
"dateReserved": "2026-08-27T15:50:09.094Z",
"dateUpdated": "2026-11-12T17:40:38.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}