Grafana Tempo EUVD-2026-25408

Exploitation requires network access to Grafana Tempo's query API endpoints (default port 3200 or as configured). The CVSS vector PR:N confirms no authentication is required if the Tempo instance is deployed without access controls, which is common in internal monitoring environments relying on network segmentation for security. The vulnerability specifically affects deployments where max_result_limit has not been explicitly configured in the search settings, allowing clients to specify arbitrary limit values. Default Tempo configurations prior to vendor mitigation guidance lack this enforcement, making standard installations vulnerable. Exploitation is NOT limited by user interaction (UI:N) or complex attack conditions (AC:L), meaning automated scripts can trivially abuse the API. The scope:unchanged (S:U) indicates the vulnerability is confined to the Tempo component itself, not enabling lateral movement. Limiting factors include: network reachability to the query API, deployment resource constraints (containerized environments may auto-restart), and existing infrastructure-level rate limiting or WAF rules that might block excessive query patterns.

The CVSS 7.5 (High) score reflects network-accessible exploitation requiring no authentication or user interaction, with direct high impact to availability. The AV:N/AC:L/PR:N/UI:N vector indicates this can be exploited trivially by any remote caller with network access to the Tempo query API, making it highly automatable. However, real-world risk varies significantly by deployment: containerized environments with memory limits may experience pod restarts rather than complete service failure, while monolithic deployments could face total unavailability. The absence of confidentiality or integrity impact (C:N/I:N) limits this to a pure availability concern. No CISA KEV listing suggests exploitation has not been observed in critical infrastructure, and no public proof-of-concept code has been identified, reducing immediate weaponization risk. The availability of a simple configuration-based mitigation (max_result_limit) means organizations can address this without coordinating software updates, lowering remediation complexity. Priority should be HIGH for internet-exposed Tempo instances without query-side rate limiting, MEDIUM for internal deployments with resource quotas and monitoring.

An external attacker identifies an internet-exposed Grafana Tempo instance through service discovery or reconnaissance of Grafana-related endpoints. They craft HTTP queries to the Tempo search API with limit parameters set to extremely high values (e.g., limit=100000000), potentially iterating with multiple concurrent requests. Each query forces Tempo to allocate gigabytes of memory preparing result buffers, rapidly consuming available RAM. Within minutes, the Tempo process exhausts system memory, triggering out-of-memory kills or system-wide memory pressure, rendering the tracing system unavailable to legitimate monitoring operations.