Grafana Tempo EUVD-2026-38066

Exploitation requires a valid, low-privilege authenticated session against the Grafana or Tempo instance (confirmed by CVSS PR:L); unauthenticated exploitation is not possible. The attacker must have permission to execute TraceQL queries, meaning access to a Tempo datasource via Grafana or direct access to the Tempo query API endpoint. The specific triggering condition is submitting a TraceQL query that includes an exemplars hint parameter set to an abnormally large value - this is not a default query pattern and must be intentionally crafted. Exploitation is limited to authenticated users only; organizations enforcing strict RBAC and limiting TraceQL query access to specific service accounts significantly reduce the realistic attack surface. No special network position, non-default configuration beyond query access, or user interaction from a victim is required once authentication is obtained.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: network-reachable, low complexity, requiring only low-level authentication (any valid user account), with complete availability impact but zero confidentiality or integrity impact. This is a targeted DoS primitive, not a code execution or data exfiltration risk. The practical risk to organizations running Tempo as a shared observability backend is elevated - a single authenticated user (including a compromised service account or a malicious insider) can render tracing unavailable for all teams depending on that Tempo instance. No EPSS score was provided in the input data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed mass exploitation. The absence of a POC and the requirement for authentication collectively keep real-world opportunistic exploitation risk low, but insider or post-compromise scenarios are plausible without compensating controls. This should be treated as a moderate-priority patch in environments where Tempo is multi-tenant or externally accessible.

An authenticated Grafana user - such as a developer with Viewer or Editor access to a shared Tempo datasource - submits a crafted TraceQL query setting the exemplars hint to an extremely large integer (e.g., INT_MAX or similar) via the Grafana Explore panel or directly via the Tempo HTTP query API. The Tempo process attempts to allocate a memory buffer proportional to the hint value, rapidly exhausts available heap memory, and the process is killed by the OOM killer, taking down the entire Tempo service and disrupting distributed tracing for all dependent applications until the service is restarted. No public POC is known at time of analysis, but the attack primitive is straightforward for anyone familiar with TraceQL query syntax.