CVE-2026-21723: Record
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disable anonymous access to Grafana so the template test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) is not reachable by anonymous users.
- Compensating control
Apply access controls to the alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) so it is not callable without very low privileges from untrusted networks (e.g., restrict via network/ACL/WAF).
- Compensating control
Add/request rate limiting for requests to the templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) to prevent mass-executing templates in a short period that causes OOM and crashes Grafana.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21723?
The severity of CVE-2026-21723 is medium, rated at 5.3.
What impact does CVE-2026-21723 have on Grafana?
CVE-2026-21723 allows for mass execution of templates that can lead to out-of-memory (OOM) conditions and crash the Grafana service.
How can I exploit CVE-2026-21723?
CVE-2026-21723 can be exploited by sending requests to the /api/alertmanager/grafana/config/api/v1/templates/test endpoint with low privileges.
How do I fix CVE-2026-21723?
To fix CVE-2026-21723, you should implement rate limiting or apply patches provided by Grafana to mitigate the OOM condition.
What version of Grafana is affected by CVE-2026-21723?
CVE-2026-21723 affects certain versions of Grafana that expose the vulnerable alertmanager templates test endpoint.