Filtered by vendor Grafana Subscriptions
Filtered by product Elasticsearch Datasource Subscriptions

Search

Switch to Advanced Search (Beta)
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-81843 1 Grafana 3 Elasticsearch Datasource, Grafana, Grafana Enterprise 2026-11-13 6.5 Medium
Grafana is an open-source platform for monitoring and observability. When an Elasticsearch data source is configured with a time-based index pattern, Grafana generated one index name for every interval in the requested query time range without any upper limit. A user with permission to query the data source, which includes users holding only the Viewer role in a default configuration, could submit a single small query with an extreme time range and cause the server to allocate memory until it was terminated. The allocation occurred before any request was sent to Elasticsearch, so the condition applied whether or not the Elasticsearch cluster was reachable. Data sources configured with a static index name are not affected.
CVE-2026-106475 1 Grafana 3 Elasticsearch Datasource, Grafana, Grafana Enterprise 2026-11-13 7.1 High
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]