EUVD-2026-38066
GHSA-6xff-cpcq-vpw2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable query API requires authenticated low-privilege user; no complexity barrier; pure availability impact only via OOM crash; no scope change.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
AnalysisAI
Grafana Tempo and Enterprise Traces (GET) are vulnerable to an authenticated denial-of-service condition triggered by submitting a TraceQL query containing an excessively large exemplars hint value, causing the Tempo service to allocate unbounded memory until an out-of-memory crash occurs. Any authenticated user with query access - even low-privileged - can exploit this to take down the Tempo tracing backend, disrupting observability pipelines for the entire platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, low-privilege authenticated session against the Grafana or Tempo instance (confirmed by CVSS PR:L); unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: network-reachable, low complexity, requiring only low-level authentication (any valid user account), with complete availability impact but zero confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Grafana user - such as a developer with Viewer or Editor access to a shared Tempo datasource - submits a crafted TraceQL query setting the exemplars hint to an extremely large integer (e.g., INT_MAX or similar) via the Grafana Explore panel or directly via the Tempo HTTP query API. The Tempo process attempts to allocate a memory buffer proportional to the hint value, rapidly exhausts available heap memory, and the process is killed by the OOM killer, taking down the entire Tempo service and disrupting distributed tracing for all dependent applications until the service is restarted. … |
| Remediation | The primary remediation is to apply the vendor-released patch as documented in the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-27878 - the exact fixed version is not specified in the available intelligence and must be confirmed from that source before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Arbitrary file read and write in the Grafana Snowflake datasource plugin (versions 1.14.7 through 1.14.12) allows authen
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to rea
Share
External POC / Exploit Code
Leaving vuln.today