CVE-2026-27878 - Vulnerability Details - OpenCVE

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Grafana	Enterprise Metrics Tempo

No data.

No data.

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2026-27878

History

Wed, 24 Jun 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Grafana Grafana enterprise Metrics Grafana tempo
Vendors & Products		Grafana Grafana enterprise Metrics Grafana tempo

Mon, 22 Jun 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 19 Jun 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400

Fri, 19 Jun 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Title		Tempo TraceQL query with exemplar hint could result in unbounded memory usage
References		https://grafana.com/security/security-advisories/cve-2026-27878
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2026-06-19T19:02:27.028Z

Updated: 2026-06-23T12:14:04.829Z

Reserved: 2026-02-24T14:30:17.726Z

Link: CVE-2026-27878

Vulnrichment

Updated: 2026-06-22T17:09:58.772Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27878", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-02-24T14:30:17.726Z", "datePublished": "2026-06-19T19:02:27.028Z", "dateUpdated": "2026-06-23T12:14:04.829Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-06-22T16:31:13.910Z"}, "datePublic": "2026-03-23T19:28:24.658Z", "title": "Tempo TraceQL query with exemplar hint could result in unbounded memory usage", "descriptions": [{"lang": "en", "value": "A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service."}], "affected": [{"vendor": "Grafana", "product": "Enterprise Traces (GET)", "defaultStatus": "unaffected", "versions": [{"version": "2.6.1", "status": "affected", "versionType": "semver", "lessThan": "2.8.8"}]}, {"vendor": "Grafana", "product": "Tempo", "defaultStatus": "unaffected", "versions": [{"version": "2.6.0", "status": "affected", "versionType": "semver", "lessThan": "2.10.2"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-27878", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "source": {"discovery": "INTERNAL_FINDING"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T17:09:51.414285Z", "id": "CVE-2026-27878", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T12:14:04.829Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27878", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:09:51.414285Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:09:58.772Z"}}], "cna": {"title": "Tempo TraceQL query with exemplar hint could result in unbounded memory usage", "source": {"discovery": "INTERNAL_FINDING"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Enterprise Traces (GET)", "versions": [{"status": "affected", "version": "2.6.1", "lessThan": "2.8.8", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Tempo", "versions": [{"status": "affected", "version": "2.6.0", "lessThan": "2.10.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-23T19:28:24.658Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-27878", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-06-22T16:31:13.910Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27878", "state": "PUBLISHED", "dateUpdated": "2026-06-23T12:14:04.829Z", "dateReserved": "2026-02-24T14:30:17.726Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-06-19T19:02:27.028Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}