CVE-2026-27878 PUBLISHED

Tempo TraceQL query with exemplar hint could result in unbounded memory usage

Assigner: GRAFANA
Reserved: 24.02.2026 Published: 19.06.2026 Updated: 19.06.2026

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor Grafana
Product Enterprise Traces (GET)
Versions Default: unaffected
  • affected from 2.6.1 to 2.8.8 (excl.)
Vendor Grafana
Product Tempo
Versions Default: unaffected
  • affected from 2.6.0 to 2.10.2 (excl.)

References