| id: GO-2026-6541 |
| modules: |
| - module: github.com/grafana/grafana |
| non_go_versions: |
| - fixed: 1.9.2-0.20260616075434-82ef13993059 |
| vulnerable_at: 5.4.5+incompatible |
| - module: github.com/grafana/grafana |
| non_go_versions: |
| - introduced: 13.0.0 |
| vulnerable_at: 5.4.5+incompatible |
| - module: github.com/grafana/grafana |
| non_go_versions: |
| - introduced: 12.4.0 |
| vulnerable_at: 5.4.5+incompatible |
| - module: github.com/grafana/grafana |
| non_go_versions: |
| - introduced: 12.3.0 |
| vulnerable_at: 5.4.5+incompatible |
| - module: github.com/grafana/grafana |
| non_go_versions: |
| - introduced: 12.0.0 |
| vulnerable_at: 5.4.5+incompatible |
| - module: github.com/grafana/grafana |
| versions: |
| - introduced: 2.0.0-beta1+incompatible |
| vulnerable_at: 5.4.5+incompatible |
| summary: |- |
| Grafana: Pre-authentication denial of service in the public dashboard query |
| handler in github.com/grafana/grafana |
| cves: |
| - CVE-2026-42127 |
| ghsas: |
| - GHSA-3w66-95m3-8jxg |
| references: |
| - advisory: https://github.com/advisories/GHSA-3w66-95m3-8jxg |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-42127 |
| - fix: https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4 |
| - fix: https://github.com/grafana/grafana/pull/125789 |
| - web: https://github.com/grafana/grafana/releases/tag/v11.6.15 |
| - web: https://github.com/grafana/grafana/releases/tag/v12.2.9 |
| - web: https://github.com/grafana/grafana/releases/tag/v12.3.7 |
| - web: https://github.com/grafana/grafana/releases/tag/v12.4.4 |
| - web: https://github.com/grafana/grafana/releases/tag/v13.0.2 |
| - web: https://grafana.com/security/security-advisories/cve-2026-42127 |
| notes: |
| - fix: 'module merge error: could not merge versions of module github.com/grafana/grafana: introduced and fixed versions must alternate' |
| source: |
| id: GHSA-3w66-95m3-8jxg |
| created: 2026-09-22T10:09:48.252869-04:00 |
| review_status: UNREVIEWED |
