The vulnerability identified as CVE-2026-42127 in Grafana Enterprise involves the public dashboard query endpoint failing to enforce limits on the size of the request body before processing. This flaw enables unauthenticated attackers to submit very large JSON payloads, which triggers excessive memory allocation on the server. The result is a denial of service condition due to memory exhaustion. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The affected versions explicitly include 11.6.0, 12.2.0, 12.3.0, 12.4.0, and 13.0.0. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation leads to denial of service by exhausting server memory resources, disrupting availability of the Grafana Enterprise service. Since no authentication is required, the attack surface is broad, allowing any unauthenticated user to trigger the condition. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as limiting request sizes or rate limiting access to the public dashboard query endpoint to mitigate potential exploitation.