The vulnerability exists in the /api/alertmanager/grafana/config/api/v1/templates/test endpoint of Grafana OSS. This endpoint executes alertmanager templates with no memory restrictions, allowing an attacker to mass-execute templates in a short time frame, causing the service to run out of memory and crash. The endpoint requires only low privileges and is exploitable when anonymous access is enabled. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact (service crash). No official patch or remediation level is currently stated, and no known exploits are reported in the wild.

Successful exploitation results in denial of service by causing the Grafana service to crash due to out-of-memory conditions. There is no reported impact on confidentiality or integrity. The vulnerability requires low privileges and can be exploited remotely over the network if anonymous access is enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable anonymous access to Grafana OSS to prevent exploitation of this endpoint. Monitor and restrict access to the alertmanager templates test endpoint as a temporary mitigation.