CVE-2026-21728

HighDDoS

Published: 24 April 2026

Published

24 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0002 5.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21728 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Grafana (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).

Deeper analysis

CVE-2026-21728 is a denial-of-service vulnerability in Grafana Tempo, where Tempo queries specifying large limits trigger excessive memory allocations. This can degrade or disrupt service availability based on the deployment configuration. The issue stems from uncontrolled resource consumption (CWE-400) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

Any unauthenticated attacker with network access to the Tempo service can exploit this vulnerability by submitting crafted queries with excessively large result limits. Successful exploitation leads to significant memory exhaustion, potentially causing the service to become unresponsive or crash, thereby denying legitimate users access to query functionality.

The Grafana security advisory recommends mitigation by configuring a maximum result limit in the search settings, such as setting max_result_limit to 262144 (2^18), to cap memory usage from oversized queries. Affected users should apply this configuration update promptly.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-25408

Vulnerability details

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).

CWE(s): CWE-400

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Unauthenticated remote exploitation of public-facing Tempo service (T1190) via crafted queries triggers application/system crash through resource exhaustion (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1