Resource exhaustion in Grafana Enterprise Traces (Get)
CVE-2026-21728
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 26…
Vulnerability class: DoS (Denial of Service)
EPSS: 0.006 (46.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Grafana Enterprise Traces (Get) — versions 1.0.0
- Grafana Tempo — versions 1.3.0, v1.3.0, 2.9.0
Weakness classification (CWE)
References
- security@grafana.com (vendor-advisory, Broken Link)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-21728?
- CVE-2026-21728 is a high-severity vulnerability in Grafana Enterprise Traces (Get), classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-04-24.
- How severe is CVE-2026-21728?
- High severity. CVSS v3 base score is 7.5 out of 10.