CVE-2026-27878 — Tempo TraceQL query with exemplar hint could result in unbounded memory usage

CVE-2026-27878

Tempo TraceQL query with exemplar hint could result in unbounded memory usage PUBLISHED

Description (CNA)

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

Affected (CNA)

Vendor / product	Versions
Grafana / Enterprise Traces (GET)	affected 2.6.1 before 2.8.8
Grafana / Tempo	affected 2.6.0 before 2.10.2

CWE

No CWE identifiers supplied.

References

https://grafana.com/security/security-advisories/cve-2026-27878

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.