CVE-2026-27878: Grafana Tempo Memory Exhaustion Denial of Service

Technical summary

CVE-2026-27878 is a resource exhaustion vulnerability affecting Grafana Tempo. When processing TraceQL queries, the service fails to properly validate or limit the exemplars hint parameter. An attacker providing an abnormally large value causes unbounded memory allocation during query execution, triggering an out-of-memory condition (CWE-400). The vulnerability requires authentication, limiting the attack surface to authorized users or those with compromised credentials. The CVSS 3.1 score of 6.5 reflects a network-accessible service with no complexity barrier, but impact limited to availability.

Business impact

Exploitation results in direct service unavailability for Grafana Tempo instances. Organizations relying on Tempo for distributed tracing and observability lose visibility into application performance and request flows during an outage. Recovery requires manual intervention to restart the service. The threat is elevated in multi-tenant or shared Tempo environments where a single authenticated user can degrade service for all tenants. Attack persistence depends on whether the attacker retains access; repeated exploitation is possible if credentials remain valid.

Affected systems

Grafana Tempo is affected. Specific vulnerable versions are not detailed in the available advisory data—verify your deployment version against the official Grafana security advisory. Environments where Tempo is exposed to internal networks or where user account provisioning is broad (e.g., all developers, contractors, or application service accounts) face higher exposure. Tempo instances configured as multi-tenant backends are particularly at risk.

Exploitability

Exploitation requires valid authentication to Tempo, reducing the attack surface compared to unauthenticated flaws. No special tools or complex techniques are needed; a standard TraceQL query with a large exemplars hint value is sufficient. The simplicity of crafting a malicious query and the immediate, noticeable impact (service crash) make this straightforward to exploit once credentials are obtained. Insider threats or compromised service accounts pose the primary risk.

Remediation

Apply the security update released by Grafana for CVE-2026-27878. Verify the patched version against the official Grafana advisory, as specific version numbers should be confirmed against vendor guidance. Until patching is possible, implement network segmentation to restrict Tempo access to trusted clients, enforce multi-factor authentication for Tempo user accounts, and monitor query patterns for suspicious exemplars hint values. Consider deploying Tempo behind a reverse proxy with request validation rules.

Patch guidance

Consult the official Grafana Tempo security advisory to identify the patched version applicable to your deployment. Patches are typically backported to multiple release branches. Plan patching during a maintenance window to accommodate service restarts. Verify patch deployment by confirming the Tempo instance version and testing basic query functionality post-update. If your organization uses Tempo in a containerized environment, update the base image or tag reference and redeploy instances.

Detection guidance

Monitor Tempo instance memory usage for sudden spikes or sustained high allocation. Alert on out-of-memory errors or service restarts. Examine Tempo query logs for TraceQL queries with unusually large exemplars hint values—typical queries should have modest hint parameters in the thousands to tens of thousands range. Correlate memory events with authentication logs to identify potential attackers. Network-level monitoring can flag rapid repeated query submissions from a single authenticated session. Consider deploying distributed tracing health checks that periodically validate query performance and memory behavior.

Why prioritize this

This vulnerability merits prompt attention due to the combination of straightforward exploitability (requiring only valid credentials and a simple query) and direct business impact (availability loss). While the CVSS score of 6.5 is moderate, the practicality of the attack and the centrality of observability platforms in modern infrastructure elevate real-world risk. Organizations should prioritize patching, especially if Tempo is business-critical or exposed to a broad user base.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects a network-accessible service (AV:N), low attack complexity (AC:L), and required privilege level (PR:L), with high impact on availability (A:H). The score does not account for contextual factors such as whether Tempo is internet-facing, the sensitivity of tracing data, or the blast radius in multi-tenant scenarios. Your organization's risk may differ based on Tempo's role in your observability stack and the breadth of account access.

Frequently asked questions