{"id":"CVE-2026-81843","kind":"vulnerability","aliases":["CVE-2026-81843"],"related":[],"title":"Grafana: Elasticsearch time-based index queries can exhaust server memory","description":"Grafana is an open-source platform for monitoring and observability.\n\nWhen an Elasticsearch data source is configured with a time-based index pattern, Grafana\ngenerated one index name for every interval in the requested query time range without any upper\nlimit. A user with permission to query the data source, which includes users holding only the\nViewer role in a default configuration, could submit a single small query with an extreme time\nrange and cause the server to allocate memory until it was terminated. The allocation occurred\nbefore any request was sent to Elasticsearch, so the condition applied whether or not the\nElasticsearch cluster was reachable.\n\nData sources configured with a static index name are not affected.","summary":"Grafana builds one Elasticsearch index name for every time interval in a query, with no upper limit. A user who can query such a data source can send one small query with an extreme time range and make the Grafana server run out of memory until it is terminated.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elasticsearch","grafana","runtime","self-hosted"],"not_affected_if":["no-elasticsearch-datasource","static-index-name"],"how_to_check":"- Check whether any Elasticsearch data source in Grafana uses a time-based index pattern (an index pattern with a date interval such as [logs-]YYYY.MM.DD), not a static index name.\n- Check the installed Grafana version with `grafana server -v` or the Grafana UI build info, and compare it with the fixed versions below.","fix":null,"status":"open","published_at":"2026-11-12T18:17:53+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:42:58+00:00","updated_at":"2026-11-12T18:42:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T18:42:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: Elasticsearch time-based index queries can exhaust server memory","impact":"medium","summary":"Grafana builds one Elasticsearch index name for every time interval in a query, with no upper limit. A user who can query such a data source can send one small query with an extreme time range and make the Grafana server run out of memory until it is terminated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["grafana","elasticsearch","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"A single crafted query crashes the Grafana server through memory exhaustion.","analyst_note":"Fixed versions are not in the sources; check the Grafana security advisory for CVE-2026-81843 at https://nvd.nist.gov/vuln/detail/CVE-2026-81843 or the Grafana project advisories for the patched release.","how_to_check":"- Check whether any Elasticsearch data source in Grafana uses a time-based index pattern (an index pattern with a date interval such as [logs-]YYYY.MM.DD), not a static index name.\n- Check the installed Grafana version with `grafana server -v` or the Grafana UI build info, and compare it with the fixed versions below.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["static-index-name","no-elasticsearch-datasource"],"who_is_affected":"Only Grafana instances with an Elasticsearch data source that uses a time-based index pattern are affected. Data sources with a static index name are not affected. Any user with permission to query such a data source can trigger it, including users holding only the Viewer role in a default configuration, so exposure depends on who can reach the Grafana server.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000784,"input_tokens":4641,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-81843':14A,17A 'affect':191C 'alloc':153C,160C 'appli':172C 'base':5A,95C 'build':25B 'caus':149C 'cluster':178C 'condit':171C 'configur':90C,136C,183C 'could':137C 'cve':12A,15A 'data':48B,87C,123C,181C 'default':135C 'elasticsearch':2A,18B,27B,86C,168C,177C 'everi':31B,104C 'exhaust':9A 'extrem':57B,145C 'generat':99C 'grafana':1A,19B,24B,63B,73C,98C 'hold':128C 'host':23B 'includ':126C 'index':6A,28B,96C,101C,187C 'interv':33B,105C 'limit':40B,115C 'make':61B 'memori':11A,68B,154C 'monitor':81C 'name':29B,102C,188C 'observ':83C 'occur':161C 'one':26B,52B,100C 'open':77C 'open-sourc':76C 'pattern':97C 'permiss':119C 'platform':79C 'queri':7A,36B,45B,54B,109C,121C,142C 'rang':59B,111C,147C 'reachabl':180C 'request':108C,164C 'role':132C 'run':65B 'runtim':20B 'self':22B 'self-host':21B 'send':51B 'sent':166C 'server':10A,64B,151C 'singl':140C 'small':53B,141C 'sourc':49B,78C,88C,124C,182C 'static':186C 'submit':138C 'termin':72B,158C 'time':4A,32B,58B,94C,110C,146C 'time-bas':3A,93C 'upper':39B,114C 'user':42B,117C,127C 'viewer':131C 'whether':173C 'without':112C","nicknames":[],"mitigations":[],"who_affected":"Only Grafana instances with an Elasticsearch data source that uses a time-based index pattern are affected. Data sources with a static index name are not affected. Any user with permission to query such a data source can trigger it, including users holding only the Viewer role in a default configuration, so exposure depends on who can reach the Grafana server.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elasticsearch","grafana","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-81843':14A,17A 'base':5A 'cve':12A,15A 'elasticsearch':2A 'exhaust':9A 'grafana':1A 'index':6A 'memori':11A 'queri':7A 'server':10A 'time':4A 'time-bas':3A","search_b":"'build':25B 'data':48B 'elasticsearch':18B,27B 'everi':31B 'extrem':57B 'grafana':19B,24B,63B 'host':23B 'index':28B 'interv':33B 'limit':40B 'make':61B 'memori':68B 'name':29B 'one':26B,52B 'queri':36B,45B,54B 'rang':59B 'run':65B 'runtim':20B 'self':22B 'self-host':21B 'send':51B 'server':64B 'small':53B 'sourc':49B 'termin':72B 'time':32B,58B 'upper':39B 'user':42B","search_c":"'affect':191C 'alloc':153C,160C 'appli':172C 'base':95C 'caus':149C 'cluster':178C 'condit':171C 'configur':90C,136C,183C 'could':137C 'data':87C,123C,181C 'default':135C 'elasticsearch':86C,168C,177C 'everi':104C 'extrem':145C 'generat':99C 'grafana':73C,98C 'hold':128C 'includ':126C 'index':96C,101C,187C 'interv':105C 'limit':115C 'memori':154C 'monitor':81C 'name':102C,188C 'observ':83C 'occur':161C 'one':100C 'open':77C 'open-sourc':76C 'pattern':97C 'permiss':119C 'platform':79C 'queri':109C,121C,142C 'rang':111C,147C 'reachabl':180C 'request':108C,164C 'role':132C 'sent':166C 'server':151C 'singl':140C 'small':141C 'sourc':78C,88C,124C,182C 'static':186C 'submit':138C 'termin':158C 'time':94C,110C,146C 'time-bas':93C 'upper':114C 'user':117C,127C 'viewer':131C 'whether':173C 'without':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81843","severity":null,"published_at":"2026-11-12T18:17:53+00:00","modified_at":"2026-11-12T18:17:53+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}