The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Thu, 23 Jul 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled. | |
| Title | CVE-2026-21723 Record | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GRAFANA
Published:
Updated: 2026-07-23T01:48:16.245Z
Reserved: 2026-01-05T09:26:06.214Z
Link: CVE-2026-21723
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.