Tempo TraceQL query with exemplar hint could result in unbounded memory usage
Priority LOW 29CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Fixed Enterprise Traces (GET) (Grafana): 2.8.8Tempo (Grafana): 2.10.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | Enterprise Traces (GET) | 2.6.1 to before 2.8.8 | 2.8.8 | Patch available | CNA |
| Grafana | Tempo | 2.6.0 to before 2.10.2 | 2.10.2 | Patch available | CNA |
| — | github.com/grafana/tempo (Go) | before 1.5.1-0.20260303204923-b13f74291d48 | 1.5.1-0.20260303204923-b13f74291d48 | Patch available | GHSA-6xff-cpcq-vpw2 |
- Enterprise Traces (GET) VendorGrafana Affected 2.6.1 to before 2.8.8 Fixed in 2.8.8 Patch available CNA
- Tempo VendorGrafana Affected 2.6.0 to before 2.10.2 Fixed in 2.10.2 Patch available CNA
- github.com/grafana/tempo (Go) Vendor— Affected before 1.5.1-0.20260303204923-b13f74291d48 Fixed in 1.5.1-0.20260303204923-b13f74291d48 Patch available GHSA-6xff-cpcq-vpw2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:* | 2.6.0 to before 2.8.4; 2.9.0 to before 2.9.2; 2.10.0 to before 2.10.2 | Vulnerable | Grafana |
- cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.8.4; 2.9.0 to before 2.9.2; 2.10.0 to before 2.10.2 Vulnerable ·Grafana
Remediation
- Fix · CNA Enterprise Traces (GET) (Grafana) Fixed in 2.8.8
- Fix · CNA Tempo (Grafana) Fixed in 2.10.2
- Fix · GHSA-6xff-cpcq-vpw2 github.com/grafana/tempo (Go) Fixed in 1.5.1-0.20260303204923-b13f74291d48 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27878
- 2026-10-03 Alias added: GHSA-6xff-cpcq-vpw2
References
Advisory 2
Other 12
- https://github.com/grafana/tempo/pull/6559
- https://github.com/grafana/tempo/pull/6646
- https://github.com/grafana/tempo/pull/6792
- https://github.com/grafana/tempo/pull/6802
- https://github.com/grafana/tempo/commit/3d7c78d438890991df594c20ae2031f8934aba3b
- https://github.com/grafana/tempo/commit/b13f74291d489672601a10297f8fbcbf7dd19192
- https://github.com/grafana/tempo/commit/b481ae9693f99785691197915066e6306950fa09
- https://github.com/grafana/tempo/commit/e2d51b786aff94de3319c07994c6a5539b121eb5
- https://github.com/grafana/tempo
- https://github.com/grafana/tempo/releases/tag/v2.10.2
- https://github.com/grafana/tempo/releases/tag/v2.8.4
- https://github.com/grafana/tempo/releases/tag/v2.9.2
More Grafana Tempo vulnerabilities
- TI-2026-17501 Tempo query limit results in unbounded memory allocation CVSS 3.1HIGH 7.5
- TI-2026-22653 S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) CVSS 3.1HIGH 7.5
Sources
- CVE-2026-27878 · CVE Program
- CVE-2026-27878 · NVD
- FIRST EPSS
- GHSA-6xff-cpcq-vpw2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences