CVE-2026-27878: Tempo TraceQL query with exemplar hint could result in unbounded memory usage
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Tempo service and its TraceQL query endpoints to trusted networks and users. Enforce network-level controls (firewall, ACLs, VPN) so only authorized IP ranges or internal networks can reach Tempo, and apply least-privilege access for authenticated accounts that can run TraceQL queries.
- Compensating control
Apply external protections to limit the impact of potentially expensive TraceQL queries: implement query rate-limiting and enforce query timeouts at the API/gateway or reverse proxy layer, and apply host/container memory limits and restart policies so a single query cannot consume unbounded memory and crash the service.
- Operational
Monitor Tempo memory usage and query activity closely; configure alerts for elevated memory usage or OOM events and ensure automated recovery (process/container restart) and on-call procedures are in place to respond to denial-of-service conditions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27878?
The severity of CVE-2026-27878 is medium with a score of 6.5.
How does CVE-2026-27878 affect Grafana Tempo?
CVE-2026-27878 can cause Grafana Tempo to allocate excessive memory, leading to potential out-of-memory crashes.
What is the risk associated with CVE-2026-27878?
The risk associated with CVE-2026-27878 is rated at 38, indicating a denial of service potential for authenticated users.
How do I mitigate CVE-2026-27878?
Mitigation for CVE-2026-27878 involves limiting the size of exemplar hint values in TraceQL queries.
Who is affected by CVE-2026-27878?
Authenticated users of Grafana Tempo can exploit CVE-2026-27878 to trigger a denial of service.