Memory Exhaustion Vulnerability in Grafana

CVE-2026-21723

What is CVE-2026-21723?

The Grafana alertmanager templates test endpoint allows for template execution without imposing memory limits, leading to potential denial-of-service conditions. When exploited, an attacker can initiate the execution of multiple templates in quick succession, resulting in out-of-memory (OOM) errors that crash the Grafana service. This vulnerability poses a risk especially when anonymous access is enabled, as it requires minimal privileges to exploit. It is crucial for users to remain vigilant and update to the latest version to mitigate these risks.

References