CVE-2026-21728

High

Published: 24 April 2026

Published

24 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0002 4.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21728 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Grafana (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-5 Denial-of-service Protection good match

prevent

Directly protects against denial-of-service events like excessive memory allocations triggered by large query limits in Tempo.

SC-6 Resource Availability good match

prevent

Implements safeguards to protect resource availability from uncontrolled consumption caused by oversized Tempo queries.

SI-10 Information Input Validation good match

prevent

Validates information inputs such as query limit parameters to block excessively large values that cause memory exhaustion.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Unauthenticated remote exploitation of public-facing Tempo service (T1190) via crafted queries triggers application/system crash through resource exhaustion (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).

Deeper analysisAI

CVE-2026-21728 is a denial-of-service vulnerability in Grafana Tempo, where Tempo queries specifying large limits trigger excessive memory allocations. This can degrade or disrupt service availability based on the deployment configuration. The issue stems from uncontrolled resource consumption (CWE-400) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

Any unauthenticated attacker with network access to the Tempo service can exploit this vulnerability by submitting crafted queries with excessively large result limits. Successful exploitation leads to significant memory exhaustion, potentially causing the service to become unresponsive or crash, thereby denying legitimate users access to query functionality.

The Grafana security advisory recommends mitigation by configuring a maximum result limit in the search settings, such as setting max_result_limit to 262144 (2^18), to cap memory usage from oversized queries. Affected users should apply this configuration update promptly.