CVE-2026-21723 in Grafana
Summary
by MITRE • 07/23/2026
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability resides in the alertmanager templates test endpoint within Grafana's API, specifically at /api/alertmanager/grafana/config/api/v1/templates/test. This endpoint allows template execution without any memory constraints or resource limitations, creating a critical security and stability risk. The flaw enables arbitrary template processing that can consume excessive system resources, ultimately leading to out-of-memory conditions and complete service crashes. The vulnerability is particularly dangerous because it operates with minimal privilege requirements, making it accessible even when anonymous access is enabled, which means unauthenticated attackers can exploit it without needing valid credentials.
The technical implementation of this vulnerability stems from the absence of resource management controls around template execution within Grafana's alertmanager component. When templates are processed through this test endpoint, there are no safeguards preventing excessive memory consumption or CPU usage patterns that could overwhelm the system resources. This behavior creates a denial-of-service condition where an attacker can submit malicious or resource-intensive templates designed to consume all available memory, causing the Grafana service to crash and become unavailable to legitimate users. The lack of memory limits, execution timeouts, or resource quotas in the template processing engine directly enables this exploitation vector.
The operational impact of this vulnerability extends beyond simple service disruption to encompass potential system compromise and data availability issues. When exploited successfully, attackers can cause complete Grafana service outages, affecting monitoring and alerting capabilities across organizations that rely on the platform for system health tracking. The low privilege requirements and anonymous access exploitability mean that even unauthenticated users can trigger these crashes, making it particularly dangerous in environments where public access is permitted or when default configurations are left unchanged. This vulnerability undermines the reliability of Grafana as a monitoring solution and can lead to missed critical alerts during service disruptions.
Organizations should implement immediate mitigations including restricting access to the vulnerable endpoint through network-level controls, disabling anonymous access where possible, and implementing rate limiting for template processing operations. The most effective long-term solution involves modifying the Grafana configuration to enforce memory limits on template execution, implementing proper resource quotas, and adding timeout mechanisms to prevent indefinite template processing. Additionally, organizations should conduct regular security assessments of their monitoring infrastructure, ensure proper network segmentation, and maintain up-to-date deployment configurations that disable unnecessary public endpoints. This vulnerability aligns with CWE-400 (Uncontrolled Resource Consumption) and can be categorized under ATT&CK technique T1499.004 (Endpoint Denial of Service) within the adversary tactics framework.