The vulnerability in Grafana OSS (CVE-2026-21723) involves the alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) which executes templates with no memory usage limits. An attacker can cause a denial of service by triggering mass template executions in a short time frame, resulting in out-of-memory conditions and crashing the Grafana service. The endpoint requires only low privileges and can be exploited if anonymous access is enabled. The affected versions are explicitly listed as 8.0.0, 11.0.0, and 12.0.0 through 12.3.0. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impact limited to availability (service crash). There is no vendor advisory or patch information available at this time.

Successful exploitation can cause denial of service by crashing the Grafana service due to out-of-memory conditions triggered by uncontrolled template execution. There is no impact on confidentiality or integrity reported. The service disruption could affect availability of Grafana OSS instances running the affected versions, especially if anonymous access is enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable anonymous access to the affected endpoint to prevent exploitation. Restricting access to the alertmanager templates test endpoint and monitoring usage patterns may help mitigate risk. No official patch or workaround is currently documented.