CVE-2026-27878 Tempo TraceQL query with exemplar hint could result in unbounded memory usage

What is CVE-2026-27878?

CVE-2026-27878 is a medium-severity denial of service vulnerability in Grafana Enterprise Traces (GET), published on 19 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

Weakness: CWE-400

Which versions are affected by CVE-2026-27878?

3 open source packages ship an affected version, including github.com/grafana/tempo. It affects 1 product.

Products include Grafana Tempo.

How do I fix CVE-2026-27878?

Upgrade github.com/grafana/tempo to 1.5.1-0.20260303204923-b13f74291d48 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-27878 being exploited?

There is no known exploitation of CVE-2026-27878 in the wild and no public exploit code.

Other vulnerabilities in Grafana Enterprise Traces (GET)

• CVE-2026-21728 Tempo query limit results in unbounded memory allocation High 7.5
• CVE-2026-28377 S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ECHO-f767-d344-5c3e, GHSA-6xff-cpcq-vpw2, GO-2026-6325, MINI-2w7p-cc6j-3prm, MINI-3pwp-mrjg-5cpj, MINI-5pp6-48x6-4xr9 and 13 more.