Grafana Tempo High-Severity DoS Vulnerability Resolved — Update Required
Summary
Italy's CSIRT issued Alert AL05/260424/CSIRT-ITA disclosing a high-severity denial-of-service vulnerability in Grafana Tempo, an open-source component of the LGTM observability stack (Loki, Grafana, Tempo, Mimir). The vulnerability, tracked as CVE-2026-21728, affects all versions from v1.3.0 through v2.11.0 (exclusive) and could allow a remote attacker to compromise service availability on affected systems. CSIRT-ITA rates the system impact as Medium (CVSS 63.46) and recommends that organisations using Grafana Tempo update to a patched version as specified in Grafana's official security advisory.
Organisations operating Grafana Tempo in observability, DevOps, or infrastructure monitoring pipelines should treat this as a priority patch event. Because Grafana Tempo forms part of the distributed tracing layer in many cloud-native and SRE toolchains, unpatched instances could expose broader platform availability. Security teams should cross-reference this CVE with their CVE-2026-21728 tracking to confirm patch deployment status.
About this source
GovPing monitors Italy CSIRT Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 8 changes logged to date.
What changed
CSIRT-ITA published an alert confirming that a high-severity denial-of-service vulnerability has been resolved in Grafana Tempo by the vendor. The alert identifies CVE-2026-21728 as affecting all Grafana Tempo versions from v1.3.0 to v2.11.0 (exclusive) and rates the system impact as Medium (63.46). The sole recommended mitigation is to update affected installations to a fixed version per the Grafana security advisory.
Organisations running Grafana Tempo in any environment — particularly production observability platforms — should immediately inventory their instances, confirm whether any deployed version falls within the affected range, and apply the vendor-issued patch without delay. Failure to remediate leaves the LGTM stack exposed to remote availability compromise. This is a standard vendor-patch advisory; no specific compliance deadlines or penalties are stated.
What to do next
- Update vulnerable Grafana Tempo installations to a patched version following the vendor security advisory referenced at grafana.com/security/security-advisories/cve-2026-21728
Related changes
Get daily alerts for Italy CSIRT Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSIRT-ITA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Italy CSIRT Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.