Description
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Published: 2026-07-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerable endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) allows the execution of arbitrary templates without any memory restrictions. When an attacker submits a large or complex set of templates, Grafana can run out of memory, triggering a crash that disables the service and its dashboards.

Affected Systems

All Grafana Open Source Edition deployments that expose the Alertmanager template test endpoint are susceptible. The advisory does not list specific version ranges, so any version that has not applied the latest fix may be affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of current exploitation. Grafana is not in the CISA KEV catalog. The likely attack vector is remote HTTP, inferred from the description that the vulnerable endpoint is accessed over HTTP; the endpoint requires only low privileges and even anonymous access, making exploitation trivial for an attacker using crafted template payloads to cause a crash.

Generated by OpenCVE AI on August 4, 2026 at 15:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Grafana OSS to the latest release that includes the CVE‑2026‑21723 fix.
  • If an upgrade is unavailable, disable anonymous access or restrict the /api/alertmanager/grafana/config/api/v1/templates/test endpoint via Grafana's role‑based access controls or firewall rules.
  • Configure resource limits or enforce memory caps on the Grafana process to prevent a single template request from exhausting memory and consider disabling the template test feature if not needed.

Generated by OpenCVE AI on August 4, 2026 at 15:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Vendors & Products Grafana
Grafana grafana

Sat, 25 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Description The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Title CVE-2026-21723 Record
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Grafana Grafana
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-08-12T13:17:19.090Z

Reserved: 2026-01-05T09:26:06.214Z

Link: CVE-2026-21723

cve-icon Vulnrichment

Updated: 2026-07-23T14:16:05.319Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T03:16:30.000

Modified: 2026-07-23T17:55:03.860

Link: CVE-2026-21723

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-23T01:48:16Z

Links: CVE-2026-21723 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T15:45:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling