---
id: "CVE-2026-81843"
page: "https://infrastack.ai/live/CVE-2026-81843"
kind: "vulnerability"
aliases: ["CVE-2026-81843"]
title: "Grafana: Elasticsearch time-based index queries can exhaust server memory"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["elasticsearch", "grafana", "runtime", "self-hosted"]
not_affected_if: ["no-elasticsearch-datasource", "static-index-name"]
published_at: "2026-11-12T18:17:53+00:00"
first_seen_at: "2026-11-12T18:40:39+00:00"
updated_at: "2026-11-12T18:42:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81843", "first_seen_at": "2026-11-12T18:40:39+00:00"}]
exploit_sources: []
---

# Grafana: Elasticsearch time-based index queries can exhaust server memory

Link for people: https://infrastack.ai/live/CVE-2026-81843 (this .md is for agents)

Grafana builds one Elasticsearch index name for every time interval in a query, with no upper limit. A user who can query such a data source can send one small query with an extreme time range and make the Grafana server run out of memory until it is terminated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether any Elasticsearch data source in Grafana uses a time-based index pattern (an index pattern with a date interval such as [logs-]YYYY.MM.DD), not a static index name.
- Check the installed Grafana version with `grafana server -v` or the Grafana UI build info, and compare it with the fixed versions below.

## Timeline

- 2026-11-12T18:40:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81843

## From the sources

Grafana is an open-source platform for monitoring and observability.

When an Elasticsearch data source is configured with a time-based index pattern, Grafana
generated one index name for every interval in the requested query time range without any upper
limit. A user with permission to query the data source, which includes users holding only the
Viewer role in a default configuration, could submit a single small query with an extreme time
range and cause the server to allocate memory until it was terminated. The allocation occurred
before any request was sent to Elasticsearch, so the condition applied whether or not the
Elasticsearch cluster was reachable.

Data sources configured with a static index name are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_