CVE-2026-21723 | The alertmanager templates test endpoint (/api/alertmanager/… | CVSS 5.3 MEDIUM

Description

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

Metadata

CVE ID: CVE-2026-21723
State: PUBLISHED
Assigner: GRAFANA
Reserved: 2026-01-05 09:26 UTC
Published: 2026-07-23 01:48 UTC
Last updated: 2026-07-23 01:48 UTC
Vendor / Product: Grafana / Grafana OSS
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
Grafana	Grafana OSS	—	8.0.0 ≤ 11.0.0, 11.0.0 ≤ 11.6.10, 12.0.0 ≤ 12.0.9, 12.1.0 ≤ 12.1.6 …

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References (1)

https://grafana.com/security/security-advisories/cve-2026-21723