High severity · published Apr 24, 2026
CVE-2026-21728
Tempo query limit results in unbounded memory allocation
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
1.0.0 through 2.8.7 · source: vendor
TE
Tempo · Grafana
1.3.0 before 2.8.4; 2.9.0 before 2.9.2; 2.10.0 before 2.10.2 · source: NVD
MG
Multicluster Global Hub 1.3.4 · Red Hat
All versions, or not specified · source: CISA
MG
Multicluster Global Hub 1.4.5 · Red Hat
All versions, or not specified · source: CISA
MG
Multicluster Global Hub 1.6.5 · Red Hat
All versions, or not specified · source: CISA
MG
Multicluster Global Hub 1.7.0 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ceph Storage 5 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ceph Storage 6 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ceph Storage 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift distributed tracing 3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat multicluster global hub 1.5.3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21728
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21728
Broken Link
https://grafana.com/security/security-advisories/cve-2026-21728
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21769
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:22347
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:22423
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:23345
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:24503
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user…
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used