CVE-2026-21720: 
Grafana vulnerability analysis and mitigation

CVE-2026-21720 is a goroutine leak / uncontrolled resource consumption vulnerability in Grafana's avatar proxy endpoint that allows unauthenticated remote attackers to crash the Grafana process via a denial-of-service attack. Every uncached /avatar/:hash request spawns a goroutine to refresh the Gravatar image; if the refresh worker queue (capped at 10 slots) is full for more than three seconds, the handler times out and the goroutine blocks forever on an unbuffered channel send, causing goroutine count to grow linearly until memory is exhausted. The vulnerability affects Grafana (OSS and Enterprise) from version 3.0.0 through 11.6.8, 12.0.0–12.0.7, 12.1.0–12.1.4, 12.2.0–12.2.2, and 12.3.0. It was published on January 27, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Grafana Advisory, ENISA EUVD).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-703 (Improper Check or Handling of Exceptional Conditions). The avatar handler dispatches Gravatar refresh work to a fixed 10-slot worker queue and waits up to three seconds for a result; when the queue is saturated, the handler's context times out and returns, but the goroutine that was trying to send the result on an unbuffered channel has no receiver and blocks indefinitely — a classic goroutine leak. An unauthenticated attacker can trigger this condition by sending sustained HTTP GET requests to /avatar/<random_hash> with cache-busting hashes, ensuring each request misses the cache and enqueues a new goroutine. No authentication, special privileges, or user interaction is required, and the attack is executable over the network with low complexity (Grafana Advisory, ENISA EUVD).

Successful exploitation causes Grafana's memory to be exhausted as leaked goroutines accumulate, ultimately crashing the Grafana process on affected systems. The impact is limited to availability — there is no confidentiality or integrity impact — but a crash of the Grafana instance disrupts all monitoring, alerting, and dashboard functionality for all users of that instance. In environments where Grafana is a critical observability component, this could blind operations teams to ongoing incidents or outages (Grafana Advisory, ENISA EUVD).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.04%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA did reference it in a weekly vulnerability bulletin (SB26-033). The attack requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker once the technique is known (Grafana Advisory, CISA Bulletin).

1. Reconnaissance: Identify internet-facing or network-accessible Grafana instances running versions 3.0.0–11.6.8, 12.0.0–12.0.7, 12.1.0–12.1.4, 12.2.0–12.2.2, or 12.3.0 using tools such as Shodan, Censys, or direct HTTP probing for the Grafana login page.
2. Confirm avatar endpoint availability: Send a test GET request to http://<grafana-host>/avatar/<any_hash> and verify a 200 or redirect response, confirming the endpoint is reachable and the Gravatar proxy is active.
3. Generate cache-busting requests: Script a high-volume loop of GET requests to /avatar/<random_md5_hash> using unique random hashes per request (e.g., with curl, ab, wrk, or a custom script) to ensure each request bypasses the avatar cache and triggers a new Gravatar refresh goroutine.
4. Saturate the worker queue: Sustain the request rate high enough to keep the 10-slot worker queue continuously full, causing each new goroutine to wait more than three seconds and then block permanently on the unbuffered channel after the handler times out.
5. Achieve denial of service: As leaked goroutines accumulate, Grafana's memory consumption grows linearly. Continue the flood until the Grafana process exhausts available memory and crashes, rendering the monitoring platform unavailable (Grafana Advisory).

• Network: High volume of HTTP GET requests to /avatar/<hash> paths with unique, random hash values from one or more source IPs; unusual sustained traffic to the Grafana avatar endpoint.
• Process/Runtime: Rapidly growing goroutine count in Grafana runtime metrics (visible via /metrics endpoint if exposed); Grafana process memory consumption increasing linearly over time without a corresponding increase in legitimate user activity.
• Logs: Grafana application logs showing repeated avatar handler timeout messages or context deadline exceeded errors; access logs with many unique /avatar/ path requests in a short time window.
• System: Out-of-memory (OOM) kill events for the Grafana process in system logs (/var/log/syslog, dmesg, or journalctl); unexpected Grafana process restarts or crash reports.

Grafana has released patched versions addressing this vulnerability: 11.6.9, 12.0.8, 12.1.5, 12.2.3, and 12.3.1 (and later) for both OSS and Enterprise editions. Organizations should upgrade to one of these fixed versions as the primary remediation. As a temporary workaround where upgrading is not immediately possible, restricting network access to the /avatar/ endpoint via a reverse proxy or WAF rule (e.g., blocking or rate-limiting requests to /avatar/*) can reduce exposure. Disabling Gravatar integration in Grafana's configuration ([users] gravatar = false) may also prevent the vulnerable code path from being triggered (Grafana Advisory).

The vulnerability was assigned and disclosed by Grafana's own security team, with an official advisory published on January 27, 2026. CISA included it in its weekly vulnerability summary bulletin (SB26-033). OpenSUSE issued security update announcements for their Grafana packages, and Tenable published Nessus detection plugins (IDs 297198, 297404, 303779, 303789, 311761) for the vulnerability. Qualys also published detection coverage in their February 2026 application security detections update. No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability tracking and scanner coverage (Grafana Advisory, CISA Bulletin, OpenSUSE Advisory).