Executive brief
Grafana is a popular platform used for monitoring and visualizing data from various sources. A vulnerability in its alert management component allows users with very low privileges to crash the service by running resource-intensive tests. This can lead to a total service outage, preventing teams from viewing critical dashboards or receiving system alerts.
Technical details
A resource exhaustion vulnerability exists in the Grafana Alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test). The endpoint fails to enforce memory limits during template execution. An attacker with low privileges, or an anonymous user if anonymous access is enabled, can trigger multiple simultaneous template executions. This results in an Out-of-Memory (OOM) condition that crashes the Grafana service. The vulnerability affects multiple versions of Grafana OSS ranging from 8.0.0 to 12.3.2.
Affected products
- Grafana Grafana OSS 8.0.0 - 11.0.0, 11.0.0 - 11.6.10, 12.0.0 - 12.0.9, 12.1.0 - 12.1.6, 12.2.0 - 12.2.4, 12.3.0 - 12.3.2
Timeline
- 2026-07-23: advisory: CVE published in NVD dataset