CVE-2026-21723

Executive Summary

Business Impact: This vulnerability affects Grafana, a widely deployed observability and data visualization platform used across finance, healthcare, e-commerce, and critical infrastructure. An unauthenticated or low-privileged attacker can trigger a Denial of Service (DoS) condition by exploiting the /api/alertmanager/grafana/config/api/v1/templates/test endpoint. The likely attacker is a script kiddie or hacktivist seeking to disrupt monitoring services, or a more sophisticated actor using this as a diversionary tactic during a larger intrusion.

Vulnerability Class & Attack Vector: This is a resource exhaustion vulnerability (CWE-770). The attack vector is network-based (AV:N). The endpoint requires very low privileges (PR:L) and is exploitable with anonymous access enabled, making it accessible to unauthenticated users in many default configurations.

Urgency Assessment: The CVSS score is Medium (5.3). The EPSS exploitation probability is 0.0%, indicating no observed exploitation in the wild as of the publication date. However, the low complexity of exploitation and the potential for significant service disruption warrant immediate attention for patching and mitigation.

Key Facts:

• Vendor: Grafana
• Affected Software: Grafana (specific versions unknown)
• Patch Status: None available as of 2026-07-23
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

Qualitative Severity Label: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Metric Decomposition:

• AV:N (Network): The vulnerable endpoint is accessible over the network. No physical or local access is required.
• AC:L (Low): The attack does not require any special conditions beyond sending a crafted HTTP request. There is no race condition or complex sequence of actions.
• PR:L (Low): The endpoint requires very low privileges. In many configurations, anonymous access is enabled, effectively making this PR:N (None). The official CVSS score uses PR:L to reflect the baseline requirement.
• UI:N (None): The attacker does not need to trick or interact with another user. The attack is fully automated.
• S:U (Unchanged): A successful attack does not compromise other components of the system. The impact is confined to the Grafana service itself.
• C:N (None): No confidentiality impact. The attacker cannot read data.
• I:N (None): No integrity impact. The attacker cannot modify data.
• A:H (High): The attack causes a complete loss of availability by crashing the Grafana service via an Out-of-Memory (OOM) condition.

EPSS Interpretation: An EPSS score of 0.0% means the model predicts a very low probability of exploitation in the next 30 days. This is typical for a newly published CVE with no known exploits. This score will likely increase as analysis tools and proof-of-concept code become available.

Historical Comparison: This vulnerability is similar to other resource exhaustion flaws in web applications, such as CVE-2023-44487 (HTTP/2 Rapid Reset) and CVE-2022-22947 (Spring Cloud Gateway Code Injection leading to DoS). The common thread is the lack of input validation and resource limits on a network-accessible endpoint.

Temporal & Environmental Scores: The temporal score is currently equal to the base score (5.3) due to the lack of a patch or official exploit. The environmental score can be adjusted by the defender. If the Grafana instance is not internet-facing and is behind a strict WAF, the score could be lowered. If it is exposed to the internet with anonymous access, the score should be considered higher.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability stems from a missing resource limit on the /api/alertmanager/grafana/config/api/v1/templates/test endpoint. The Grafana Alertmanager component allows administrators to test notification templates. The endpoint processes user-supplied templates without enforcing any limits on memory allocation or execution time.

Step-by-Step Exploitation:

1. Reconnaissance: The attacker identifies a Grafana instance (e.g., via Shodan or by scanning for port 3000).
2. Authentication Bypass (Optional): If anonymous access is enabled, the attacker can skip authentication. Otherwise, they use low-privilege credentials.
3. Crafting the Payload: The attacker creates a malicious template that, when executed, consumes excessive memory. This could be a template with an infinite loop, a deeply nested structure, or one that generates a massive output string.
4. Sending the Request: The attacker sends a POST request to the vulnerable endpoint with the crafted template in the request body.
5. Resource Exhaustion: The Grafana server begins processing the template. Without memory limits, the process consumes all available RAM.
6. Denial of Service: The Grafana process is killed by the operating system's OOM killer, causing the service to crash and become unavailable.

Attack Surface:

• Interface: HTTP/HTTPS
• Port: 3000 (default Grafana port)
• Endpoint: /api/alertmanager/grafana/config/api/v1/templates/test

Pre-conditions:

• Network access to the Grafana HTTP API.
• Valid session (or anonymous access enabled).
• The Alertmanager feature must be enabled (default in modern Grafana).

Attack Variants:

• Single Request DoS: A single, carefully crafted request can cause an immediate OOM.
• Amplification DoS: An attacker with a botnet can send many smaller requests that collectively exhaust memory.

Why Standard Defenses May Fail:

• WAF: A standard WAF may not detect a template string as malicious, as it does not contain SQL injection or XSS payloads. The malicious nature is in its computational complexity, not its content.
• Rate Limiting: Rate limiting can slow down an amplification attack but will not stop a single, well-crafted request.
• Authentication: If anonymous access is enabled, authentication provides no protection.

Vulnerable vs. Patched Code Analysis

Note: Specific code is not available from the provided data. The following is a logical reconstruction based on the vulnerability description.

Vulnerable Code (Pseudocode):

@app.route('/api/alertmanager/grafana/config/api/v1/templates/test', methods=['POST'])
def test_template():
    template_string = request.json.get('template')
    # NO MEMORY LIMIT
    result = execute_template(template_string)
    return jsonify({"result": result})

Patched Code (Pseudocode):

@app.route('/api/alertmanager/grafana/config/api/v1/templates/test', methods=['POST'])
def test_template():
    template_string = request.json.get('template')
    # ENFORCE MEMORY LIMIT
    with memory_limit(MAX_TEMPLATE_MEMORY_MB):
        result = execute_template(template_string)
    return jsonify({"result": result})

Analysis: The patch introduces a memory limit (e.g., 50 MB) for template execution. If the template attempts to allocate more memory, the execution is terminated, and an error is returned. This prevents the OOM condition.

Regression Considerations: Teams applying the patch should verify that legitimate, complex templates still function correctly. The memory limit should be configurable to accommodate different deployment sizes.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-23T01:48:16.245Z
• Estimated Discovery: Unknown. The vulnerability was likely discovered through internal security research or responsible disclosure.
• Disclosure Process: The CVE was published by the CNA (likely Grafana or MITRE). No details on vendor coordination are available.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-23.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Script Kiddies: Using automated tools to disrupt services for notoriety.
• Hacktivists: Targeting organizations to protest policies or actions.
• Ransomware Operators: Using DoS as a diversion while deploying ransomware, or as a primary extortion tactic.

Attack Campaign Context: No specific campaigns are associated with this CVE at this time.

Geographic Targeting: No specific geographic patterns are expected.

Industry Verticals Most at Risk: Any organization using Grafana for critical monitoring, including:

• Financial services
• Healthcare
• E-commerce
• Cloud service providers
• Government agencies

Connection to Similar Vulnerabilities: This is a classic resource exhaustion vulnerability, similar to those found in other template engines (e.g., Jinja2, Handlebars) when input is not properly sandboxed.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Docker on a Linux host.
2. Pull Image: docker pull grafana/grafana:latest (or a specific vulnerable version).
3. Run Container: docker run -d -p 3000:3000 --name grafana-vuln grafana/grafana:latest
4. Enable Anonymous Access (Optional): Edit grafana.ini to set [auth.anonymous] enabled = true.
5. Access: Navigate to http://localhost:3000.

Prerequisites:

• Docker installed.
• Network access to the container.

Exploitation Walkthrough:

1. Craft Payload: Create a JSON payload with a template designed to consume memory. A simple example is a template that generates a very long string.

   {
     "template": "{{ 'A' * 100000000 }}"
   }
   

2. Send Request: Use curl to send the request.

   curl -X POST http://localhost:3000/api/alertmanager/grafana/config/api/v1/templates/test \
     -H "Content-Type: application/json" \
     -d '{"template": "{{ 'A' * 100000000 }}"}'
   

3. Observe DoS: The Grafana container will become unresponsive or crash. You can verify by checking the container status (docker ps) or attempting to access the web UI.

Expected Output: The curl command will hang or return an error. The Grafana service will be unavailable.

Post-Exploitation: After a successful DoS, the attacker has achieved their primary goal: service disruption. They could also use this as a smokescreen for other attacks, such as exploiting a different vulnerability while the security team is distracted.

Blue Team Section

Detection:

• Log Entries: Look for repeated POST requests to /api/alertmanager/grafana/config/api/v1/templates/test from the same IP address.
• Network Traffic: Unusually large HTTP request bodies (e.g., > 1 MB) sent to the vulnerable endpoint.
• Endpoint Indicators: The Grafana process consuming 100% CPU and rapidly increasing memory usage before crashing.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• Type: HTTP Request
• Value: POST to /api/alertmanager/grafana/config/api/v1/templates/test
• Description: The primary attack vector.

HTTP Request Patterns:

• Header: Content-Type: application/json
• Body: JSON containing a template key with a very large or complex string.
• Example Body: {"template": "{{ 'A' * 100000000 }}"}

File System Artifacts:

• Type: Core Dump
• Value: /var/log/grafana/ (or similar)
• Description: A core dump may be generated when the Grafana process is killed by the OOM killer.

Process Execution Anomalies:

• Type: Process Crash
• Value: grafana-server process terminated with signal SIGKILL (9)
• Description: The process is killed by the kernel's OOM killer.

Log Entries:

• Type: Application Log
• Value: msg="Template execution failed" error="memory limit exceeded"
• Description: This log entry would appear if a memory limit is implemented (post-patch). Pre-patch, there would be no such log.

STIX-like IOC List:

Detection Engineering

YARA Rule

rule CVE_2026_21723_Grafana_Template_DoS {
    meta:
        description = "Detects HTTP requests targeting the Grafana template test endpoint with potentially malicious payloads"
        author = "Valters IT Hub"
        date = "2026-07-23"
        reference = "https://www.valtersit.com/cve/cve-2026-21723"
        severity = "medium"
    strings:
        $endpoint = "/api/alertmanager/grafana/config/api/v1/templates/test"
        $json_key = "\"template\""
        $large_string = "A" * 1000  // Detects large repeating characters
        $nested_loop = "{{"         // Detects template syntax
    condition:
        $endpoint and $json_key and ( #large_string >= 5 or #nested_loop >= 10 )
}

Sigma Rule (SIEM)

title: CVE-2026-21723 Grafana Template Test Endpoint DoS
id: fe57a131-8fd4-4d03-a2ef-8d96a3cde419
status: experimental
description: Detects multiple POST requests to the Grafana template test endpoint, indicating a potential DoS attempt.
author: Valters IT Hub
date: 2026-07-23
references:
    - https://www.valtersit.com/cve/cve-2026-21723
logsource:
    category: webserver
    product: grafana
detection:
    selection:
        http.method: POST
        http.url: '/api/alertmanager/grafana/config/api/v1/templates/test'
    condition: selection
falsepositives:
    - Legitimate testing of alert templates by administrators
level: high

Suricata IDS Rule

alert http any any -> any 3000 (msg:"CVE-2026-21723 Grafana Template Test DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/alertmanager/grafana/config/api/v1/templates/test"; http_uri; content:"template"; http_client_body; pcre:"/\\{\\{.*\\}\\}/Ri"; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic (EQL) Query

sequence by source.ip
  [network where destination.port == 3000 and http.request.method == "POST" and url.path == "/api/alertmanager/grafana/config/api/v1/templates/test"]
  [network where destination.port == 3000 and http.request.method == "POST" and url.path == "/api/alertmanager/grafana/config/api/v1/templates/test"] with runs=5

Splunk SPL Query

index=web sourcetype=access_combined
  method=POST uri="/api/alertmanager/grafana/config/api/v1/templates/test"
  | stats count by clientip
  | where count > 10

Wazuh Rule

<group name="grafana,">
  <rule id="100001" level="10">
    <if_sid>31151</if_sid>
    <field name="url">/api/alertmanager/grafana/config/api/v1/templates/test</field>
    <description>CVE-2026-21723: Possible Grafana Template Test DoS attempt</description>
    <group>attack,denial_of_service,</group>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• Patch: No patch is available. Monitor the Grafana security page for updates.
• Compensating Control: Disable anonymous access if not required. Set [auth.anonymous] enabled = false in grafana.ini.
• Network-Level Mitigation: Block or rate-limit POST requests to /api/alertmanager/grafana/config/api/v1/templates/test at the WAF or reverse proxy level.
• Authentication Hardening: Ensure all users require authentication. Review and revoke unnecessary low-privilege accounts.

Short-term (1-7 days)

• Configuration Hardening: If the Alertmanager feature is not used, disable it entirely.
• Monitoring Implementation: Implement the detection rules provided in this report.
• Vulnerability Scanning: Use a vulnerability scanner to identify all Grafana instances in your environment.

Long-term

• Architecture Changes: Place Grafana behind a reverse proxy (e.g., Nginx) that can enforce request size limits and rate limiting.
• Security Control Improvements: Implement a Web Application Firewall (WAF) with custom rules to inspect request bodies for template syntax.
• Developer Training: Educate developers on the risks of resource exhaustion and the importance of input validation and resource limits.

Validation

To confirm you are no longer vulnerable:

1. Check Version: Run grafana-server -v and compare to the patched version (once released).
2. Test Endpoint: Attempt to send a large payload to the vulnerable endpoint. If the request is rejected or the service remains stable, the mitigation is effective.
3. Review Configuration: Verify that anonymous access is disabled and that rate limiting is in place.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21723
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-21723
• Vendor advisory: See Grafana security page
• OSV: https://osv.dev/vulnerability/CVE-2026-21723
• Related CWE: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-23 | https://www.valtersit.com/cve/cve-2026-21723