EUVD-2026-47869
GHSA-xcrm-48rh-35pj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Anonymous access is an explicit exploitation path per the description, warranting PR:N; sustained HTTP volume does not constitute true attack complexity, so AC:L better reflects the actual condition.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
AnalysisAI
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to /api/alertmanager/grafana/config/api/v1/templates/test in a short window exhausts heap memory, crashing the Grafana process entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector specifies PR:L (low-privilege authentication) as the baseline requirement; however, the description explicitly states exploitation is viable with anonymous access enabled, reducing authentication to PR:N in that deployment configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 5.3 with vector AV:N/AC:H/PR:L reflects a network-accessible availability-only flaw requiring low privileges and rated high complexity, likely because triggering OOM demands sustained rapid requests rather than a single packet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with knowledge of a Grafana instance configured with anonymous access sends a high-volume burst of POST requests to `/api/alertmanager/grafana/config/api/v1/templates/test`, each containing a valid but memory-intensive template payload. Without memory limits enforced server-side, the Grafana process rapidly exhausts available heap, triggering an OOM condition that crashes the service and denies access to all dashboards, alerts, and data sources until manually restarted. … |
| Remediation | Consult the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-21723 and apply the vendor-released patch; the exact fixed version is not independently confirmed from the available intelligence data and must be verified from that source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Client Tools for SLE 15 | Affected |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Affected |
Share
External POC / Exploit Code
Leaving vuln.today