CVE-2026-27878
Fixed in a distro release EPSS <1%CVSS 6.5
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Products: Grafana Enterprise Traces (GET), Grafana Tempo
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/tempo | 1.5.1-0.20260303204923-b13f74291d48 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | 12.4.10-r0 |
| Chainguard | commercial-grafana-13.0 | no fix |
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | no fix |
| Chainguard | grafana-12.4 | 12.4.9-r4 |
| Chainguard | grafana-13.0 | 13.0.8-r4 |
| Chainguard | grafana-fips-11.6 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | grafana-fips-12.3 | no fix |
| Chainguard | grafana-fips-12.4 | 12.4.10-r0 |
| Chainguard | grafana-fips-13.0 | 13.0.7-r2 |
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 |
| Wolfi | grafana-12.3 | no fix |
| Wolfi | grafana-12.4 | 12.4.9-r4 |
| Wolfi | grafana-13.0 | 13.0.8-r4 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 |