Executive brief
Grafana Tempo is a distributed tracing backend used to store and query trace data for observability. An authenticated user can craft a TraceQL query with an excessively large exemplars hint parameter that forces the Tempo instance to allocate unbounded memory, causing an out-of-memory crash and service outage.
Technical details
The vulnerability exists in Grafana Tempo's TraceQL query execution layer, specifically in how the exemplars hint parameter (e.g., `with(exemplars=N)`) is processed. The root cause involves two related issues: (1) a safety cap bypass where the exemplars hint value in CompileMetricsQueryRange was not validated against maxExemplars limits, and (2) the hint only applied per-shard during collection, but the frontend combiner always used the global MaxExemplars config, allowing bypassing of per-query limits. An authenticated attacker can specify an arbitrarily large exemplars hint value in a TraceQL query to trigger unbounded memory allocation and cause an out-of-memory crash. The fix involves moving hint resolution to the frontend handler's normalizeRequestExemplars function to ensure uniform application across sharder, combiner, and backend. Patches are available in Grafana Tempo v2.10.2, v2.8.4 (GET), and v2.9.2 and later.
Affected products
- Grafana Tempo < 2.8.4, >= 2.9.0 < 2.9.2, >= 2.10.0 < 2.10.2
- Grafana Enterprise Traces (GET) < 2.8.8
Timeline
- 2026-06-19: disclosed: GHSA-6xff-cpcq-vpw2 and CVE-2026-27878 published
- 2026-03-03: patched: PR #6559 merged to main branch with exemplars hint fix
- 2026-03-11: patched: Fix backported to release-v2.10 (PR #6646)
- 2026-03-26: patched: Fix backported to release-v2.8 and release-v2.9 (PR #6792, #6802)