Is CVE-2026-21728 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21728 being exploited in the wild.

How severe is CVE-2026-21728?

High severity, with a CVSS score of 7.5, published 24 April 2026.

Which products and versions are affected?

github.com/grafana/tempo (Go) SEMVER:introduced=1.3.0, SEMVER:introduced=1.3.0,fixed=2.8.4.

Is there a fix for CVE-2026-21728?

Yes. github.com/grafana/tempo (Go): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21728 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-21728?

Check whether you run github.com/grafana/tempo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21728: Grafana Tempo denial of service via large query limits

CVE-2026-21728 · Severity: high · CVSS 7.5 · Published 2026-04-24

Grafana Tempo, a tool used for managing and searching large amounts of application tracing data, is vulnerable to a denial-of-service attack. An attacker can send specially crafted search queries with very high result limits, causing the system to consume excessive amounts of memory. This can lead to service crashes or significant performance degradation, preventing users from accessing their monitoring data.

Technologies: github.com/grafana/tempo (Go). Vendors: Go.

Quick answers

Is CVE-2026-21728 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21728 being exploited in the wild.
How severe is CVE-2026-21728?: High severity, with a CVSS score of 7.5, published 24 April 2026.
Which products and versions are affected?: github.com/grafana/tempo (Go) SEMVER:introduced=1.3.0, SEMVER:introduced=1.3.0,fixed=2.8.4.
Is there a fix for CVE-2026-21728?: Yes. github.com/grafana/tempo (Go): upgrade to 2.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21728 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-21728?: Check whether you run github.com/grafana/tempo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/grafana/tempo (Go): upgrade to 2.8.4 or later
```
go get github.com/grafana/tempo@v2.8.4
```

Technical details

A resource consumption vulnerability (CWE-400) exists in Grafana Tempo versions 1.3.0 through 2.10.x. The issue stems from insufficient validation of the result limit parameter in search queries. A remote, unauthenticated attacker can trigger large memory allocations by submitting queries with extremely high limits, potentially exhausting available system memory and causing a denial-of-service (DoS) condition. The impact varies based on the deployment strategy and available resources. Users are advised to upgrade to version 2.11.0 or later, or mitigate the risk by configuring 'max_result_limit' in the search configuration (e.g., to 262144).

Affected products

Grafana Tempo >= 1.3.0, < 2.11.0

Identifiers

CVE-2026-21728
GHSA-p4r4-xvrq-gvmc
GO-2026-5528

Timeline

2026-04-24: advisory: Initial advisory published by Grafana Labs
2026-04-24: disclosed: CVE-2026-21728 published to NVD

References

https://grafana.com/security/security-advisories/cve-2026-21728

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.