Advisoriesby IbisGrafana LabsCVE-2026-21723
Grafana OSS: resource exhaustion
No fix yet
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Grafana OSS Product | >= 8.0.0, <= 11.0.0 | No fix yet |
| >= 11.0.0, <= 11.6.10 | No fix yet | |
| >= 12.0.0, <= 12.0.9 | No fix yet | |
| >= 12.1.0, <= 12.1.6 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-400