# CVE-2026-27878: Grafana Tempo denial of service via TraceQL memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-27878-grafana-tempo-denial-of-service-via-traceql-memory-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27878 · Severity: medium · CVSS 6.5 · Published 2026-06-19

Grafana Tempo is a distributed tracing backend used to store and query trace data for observability. An authenticated user can craft a TraceQL query with an excessively large exemplars hint parameter that forces the Tempo instance to allocate unbounded memory, causing an out-of-memory crash and service outage.

Technologies: [github.com/grafana/tempo (Go)](https://junglewise.ai/threats/technologies/github-com-grafana-tempo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Grafana Labs](https://junglewise.ai/threats/vendors/grafana-labs).

## Quick answers

**Is CVE-2026-27878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27878 being exploited in the wild.

**How severe is CVE-2026-27878?** Medium severity, with a CVSS score of 6.5, published 19 June 2026.

**Which products and versions are affected?** github.com/grafana/tempo (Go) < 1.5.1-0.20260303204923-b13f74291d48, SEMVER:introduced=0,fixed=1.5.1-0.20260303204923-b13f74291d48; Grafana Labs Enterprise Traces >= 2.6.1, < 2.8.8; Grafana Labs Tempo >= 2.6.0, < 2.10.2.

**Is there a fix for CVE-2026-27878?** Yes. github.com/grafana/tempo (Go): upgrade to 1.5.1-0.20260303204923-b13f74291d48 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27878 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-27878?** Check whether you run github.com/grafana/tempo (Go), Grafana Labs Enterprise Traces or Grafana Labs Tempo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/grafana/tempo (Go): upgrade to 1.5.1-0.20260303204923-b13f74291d48 or later

  ```sh
  go get github.com/grafana/tempo@v1.5.1-0.20260303204923-b13f74291d48
  ```


## Technical details

The vulnerability exists in Grafana Tempo's TraceQL query execution layer, specifically in how the exemplars hint parameter (e.g., `with(exemplars=N)`) is processed. The root cause involves two related issues: (1) a safety cap bypass where the exemplars hint value in CompileMetricsQueryRange was not validated against maxExemplars limits, and (2) the hint only applied per-shard during collection, but the frontend combiner always used the global MaxExemplars config, allowing bypassing of per-query limits. An authenticated attacker can specify an arbitrarily large exemplars hint value in a TraceQL query to trigger unbounded memory allocation and cause an out-of-memory crash. The fix involves moving hint resolution to the frontend handler's normalizeRequestExemplars function to ensure uniform application across sharder, combiner, and backend. Patches are available in Grafana Tempo v2.10.2, v2.8.4 (GET), and v2.9.2 and later.

## Affected products

- Grafana Tempo < 2.8.4, >= 2.9.0 < 2.9.2, >= 2.10.0 < 2.10.2
- Grafana Enterprise Traces (GET) < 2.8.8

## Identifiers

- CVE-2026-27878
- GHSA-6xff-cpcq-vpw2
- GO-2026-6325

## Timeline

- 2026-06-19: disclosed: GHSA-6xff-cpcq-vpw2 and CVE-2026-27878 published
- 2026-03-03: patched: PR #6559 merged to main branch with exemplars hint fix
- 2026-03-11: patched: Fix backported to release-v2.10 (PR #6646)
- 2026-03-26: patched: Fix backported to release-v2.8 and release-v2.9 (PR #6792, #6802)

## References

- [https://grafana.com/security/security-advisories/cve-2026-27878](https://grafana.com/security/security-advisories/cve-2026-27878)
- [https://github.com/grafana/tempo/pull/6559](https://github.com/grafana/tempo/pull/6559)
- [https://github.com/grafana/tempo/pull/6646](https://github.com/grafana/tempo/pull/6646)
- [https://github.com/grafana/tempo/pull/6792](https://github.com/grafana/tempo/pull/6792)
- [https://github.com/grafana/tempo/pull/6802](https://github.com/grafana/tempo/pull/6802)

## Related threats

- [Grafana Tempo denial of service via large query limits](https://junglewise.ai/threats/cve-2026-21728-grafana-tempo-denial-of-service-via-large-query-limits)
- [Grafana Tempo plaintext S3 encryption key exposure in config endpoint](https://junglewise.ai/threats/cve-2026-28377-grafana-tempo-plaintext-s3-encryption-key-exposure-in-config)