EUVD-2026-47869
GHSA-xcrm-48rh-35pj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Anonymous access is an explicit exploitation path per the description, warranting PR:N; sustained HTTP volume does not constitute true attack complexity, so AC:L better reflects the actual condition.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
Lifecycle Timeline
2DescriptionCVE.org
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
AnalysisAI
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to /api/alertmanager/grafana/config/api/v1/templates/test in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Technical ContextAI
Grafana OSS integrates a managed Alertmanager with a REST API that includes a template testing endpoint. Templates in Grafana Alertmanager are rendered using Go's text/template engine, which is invoked at request time to preview notification content. The root cause is the absence of memory quotas or concurrency controls when rendering templates via this endpoint - the engine can allocate unbounded heap memory per request. Repeated rapid calls therefore accumulate memory until the OS OOM killer terminates the Grafana process. The affected product is identified by CPE cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*, covering the open-source distribution. No CWE has been formally assigned, but this maps conceptually to CWE-400 (Uncontrolled Resource Consumption). The attack surface is further widened by Grafana's optional anonymous access feature, which, when enabled, removes even the low-privilege authentication barrier described in the CVSS vector.
RemediationAI
Consult the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-21723 and apply the vendor-released patch; the exact fixed version is not independently confirmed from the available intelligence data and must be verified from that source. As an immediate compensating control, disable anonymous access in Grafana's configuration ([auth.anonymous] enabled = false in grafana.ini) to raise the exploitation bar to at minimum low-privilege authenticated users - note this will break publicly embedded dashboard use cases. Additionally, configure network-layer or reverse-proxy rate limiting on the path /api/alertmanager/grafana/config/api/v1/templates/test to throttle mass requests; this reduces the OOM trigger surface but may slow legitimate template testing workflows. If the alertmanager templates feature is not in use, restricting access to the alertmanager API paths at the ingress level provides a lower-risk workaround until the patch is applied.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Client Tools for SLE 15 | Affected |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Affected |
Share
External POC / Exploit Code
Leaving vuln.today