CVE-2026-21723
5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grafana | Grafana OSS | 8.0.0 <= 11.0.0 | affected |
| Grafana | Grafana OSS | 11.0.0 <= 11.6.10 | affected |
| Grafana | Grafana OSS | 12.0.0 <= 12.0.9 | affected |
| Grafana | Grafana OSS | 12.1.0 <= 12.1.6 | affected |
| Grafana | Grafana OSS | 12.2.0 <= 12.2.4 | affected |
| Grafana | Grafana OSS | 12.3.0 <= 12.3.2 | affected |
Weaknesses
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.