What is the CVSS score of CVE-2026-27878?

CVE-2026-27878 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-27878?

Yes, a patch is available for CVE-2026-27878. Update the affected software to the latest version immediately.

Grafana Tempo CVE-2026-27878

EUVD-2026-38066 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-19 GRAFANA

GHSA-6xff-cpcq-vpw2

Denial Of Service Grafana Suse Tempo Enterprise Traces Get

6.5

CVSS 3.1 · Vendor: GRAFANA

Severity by source

Vendor (GRAFANA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable query API requires authenticated low-privilege user; no complexity barrier; pure availability impact only via OOM crash; no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GRAFANA).

CVSS VectorVendor: GRAFANA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 21:02 EUVD

Analysis Generated

Jun 19, 2026 - 19:33 vuln.today

DescriptionCVE.org

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

AnalysisAI

Grafana Tempo and Enterprise Traces (GET) are vulnerable to an authenticated denial-of-service condition triggered by submitting a TraceQL query containing an excessively large exemplars hint value, causing the Tempo service to allocate unbounded memory until an out-of-memory crash occurs. Any authenticated user with query access - even low-privileged - can exploit this to take down the Tempo tracing backend, disrupting observability pipelines for the entire platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Grafana Tempo is an open-source, high-volume distributed tracing backend that implements TraceQL - a purpose-built query language for trace data, analogous to PromQL for metrics. TraceQL supports query hints (including exemplars hints) that influence how the engine fetches and processes trace exemplars from storage. The vulnerability arises because Tempo does not enforce an upper bound on the exemplars hint parameter value before using it to govern memory allocation for query result buffers. When a pathologically large hint value is submitted, the allocator attempts to satisfy the request, exhausting available heap memory. The root cause class is uncontrolled resource consumption (analogous to CWE-400, though the NVD record lists CWE as N/A). Both the open-source Tempo distribution (CPE: cpe:2.3:a:grafana:tempo) and the commercial Grafana Enterprise Traces product (CPE: cpe:2.3:a:grafana:enterprise_traces_(get)) share the same query engine and are both confirmed affected.

RemediationAI

The primary remediation is to apply the vendor-released patch as documented in the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-27878 - the exact fixed version is not specified in the available intelligence and must be confirmed from that source before upgrading. Until patching is possible, operators should consider enforcing query-level rate limiting or resource quotas at the Tempo API layer (e.g., via a reverse proxy or API gateway) to cap the size of query hint parameters before they reach the Tempo engine; this limits blast radius but does not eliminate the class of vulnerability. Restricting TraceQL query access to a minimal set of trusted service accounts via Grafana RBAC reduces the attack surface, though it may impact legitimate developer workflows. Network-level controls that prevent unauthenticated or untrusted network segments from reaching the Tempo query API provide defense-in-depth but do not protect against authenticated insider misuse.