CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory (OOM) error, causing the Grafana service to crash and resulting in a Denial of Service (DoS).

This Moderate flaw in Grafana allows a remote attacker to trigger a Denial of Service by repeatedly executing alertmanager templates. While requiring low privileges, or anonymous access if enabled, the high attack complexity limits the immediate threat, as it relies on exhausting memory through mass template execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If not required, disable anonymous access to prevent unauthenticated exploitation of the Alertmanager templates test endpoint. Refer to Grafana’s official documentation for configuration details. To protect against low-privileged authenticated users triggering this flaw, configure a reverse proxy or WAF to block or strictly rate-limit traffic to /api/alertmanager/grafana/config/api/v1/templates/test.