CVE-2026-21723 CVE-2026-21723 Record
Attackers can crash Grafana by mass-executing templates via an unauthenticated endpoint, causing out-of-memory errors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21723?
CVE-2026-21723 is a medium-severity denial of service vulnerability in Grafana OSS, published on 23 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Weakness: CWE-400
Which versions are affected by CVE-2026-21723?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 8.0.0 | 11.6.11, 12.0.10, 12.1.7, 12.2.5, 12.3.3 |
How do I fix CVE-2026-21723?
Upgrade grafana to a fixed version for your release line: 11.6.11, 12.0.10, 12.1.7 or 12.2.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-21723 being exploited?
There is no known exploitation of CVE-2026-21723 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-21723, GHSA-xcrm-48rh-35pj, MINI-2f3q-xwp6-mmvx, MINI-65xq-j6q8-g7qc, MINI-7w55-xg78-h299, MINI-9pxp-r7vx-26j8 and 10 more.