CVE-2026-21723: Grafana Alertmanager DoS Vulnerability

CVE-2026-21723 Overview

CVE-2026-21723 is a denial of service vulnerability in Grafana's Alertmanager templates test endpoint. The endpoint /api/alertmanager/grafana/config/api/v1/templates/test executes templates without enforcing memory limits. Attackers can mass-execute templates in a short period to trigger out-of-memory (OOM) conditions that crash the Grafana service. The endpoint requires only low privileges and remains exploitable when anonymous access is enabled. The issue is tracked under [CWE-400] resource exhaustion patterns and affects availability of the monitoring platform.

Critical Impact
Authenticated low-privilege users, or anonymous users when anonymous access is enabled, can crash Grafana by exhausting server memory through the templates test endpoint.

Affected Products

Grafana (see vendor advisory for affected version ranges)
Grafana deployments with alertmanager enabled
Grafana instances with anonymous access enabled are exposed to unauthenticated exploitation

Discovery Timeline

2026-07-23 - CVE-2026-21723 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-21723

Vulnerability Analysis

The vulnerability resides in Grafana's Alertmanager configuration API. The templates test endpoint accepts a template payload and renders it server-side to validate output. The renderer does not cap memory allocation or bound template execution.

An attacker submits templates that allocate large data structures or produce oversized rendered output. Repeated requests in a short time window compound memory pressure on the Grafana process. The Go runtime eventually triggers an OOM condition and the service terminates.

Exploitation impacts availability only. Confidentiality and integrity are not affected. The attack complexity is elevated because it requires sustained request volume to exhaust host memory.

Root Cause

The root cause is missing resource controls on user-supplied template execution. The endpoint trusts the caller to submit reasonably sized templates. No memory ceiling, execution timeout, or rate limit constrains repeated invocations from the same principal.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates with a low-privilege Grafana account, or sends requests anonymously when anonymous access is enabled. The attacker then issues concurrent POST requests to /api/alertmanager/grafana/config/api/v1/templates/test with crafted template bodies. Sustained request volume forces the Grafana process into OOM and crashes the service.

The vulnerability mechanism is described in the Grafana Security Advisory. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-21723

Indicators of Compromise

High-volume POST requests to /api/alertmanager/grafana/config/api/v1/templates/test from a single source or authenticated user
Grafana process restarts with OOM kill signals in system logs (dmesg, journalctl)
Sudden spikes in Grafana resident memory usage preceding a crash
Repeated 5xx responses from the Alertmanager API surface

Detection Strategies

Alert on request rate anomalies against the templates test endpoint using reverse proxy or ingress logs
Correlate Grafana OOM events with authenticated user sessions and source IP addresses
Baseline normal template test usage per user and flag deviations exceeding the baseline

Monitoring Recommendations

Enable structured access logging on Grafana and forward to a centralized log platform
Monitor container or host memory metrics for the Grafana process and alert on rapid growth
Track authentication events tied to the alertmanager configuration API for low-privilege accounts

How to Mitigate CVE-2026-21723

Immediate Actions Required

Upgrade Grafana to the fixed version listed in the Grafana Security Advisory
Disable anonymous access unless it is required for a specific deployment scenario
Restrict network access to the Grafana Alertmanager API to trusted management networks
Audit user roles and remove template test permissions from accounts that do not require them

Patch Information

Grafana Labs has issued a security advisory for CVE-2026-21723. Refer to the Grafana Security Advisory for fixed version numbers and upgrade instructions. Apply the patch to all Grafana instances, including staging and internal deployments.

Workarounds

Place Grafana behind a reverse proxy and rate-limit requests to /api/alertmanager/grafana/config/api/v1/templates/test
Enforce authentication and disable the anonymous access role in grafana.ini
Apply container memory limits so a crash is contained and the orchestrator restarts the pod cleanly
Restrict the alertmanager configuration API to administrators via role-based access control

bash

# Example: disable anonymous access and restrict alertmanager API via nginx
# grafana.ini
[auth.anonymous]
enabled = false

# nginx reverse proxy rate limit
limit_req_zone $binary_remote_addr zone=grafana_tmpl:10m rate=5r/m;

location /api/alertmanager/grafana/config/api/v1/templates/test {
    limit_req zone=grafana_tmpl burst=5 nodelay;
    proxy_pass http://grafana_upstream;
}