The vulnerability CVE-2026-21728 in Grafana Tempo allows a remote attacker to cause excessive memory allocation by sending queries with large limits. This resource exhaustion can lead to a denial of service by impacting the availability of the Tempo service. The root cause is the allocation of resources without proper limits or throttling (CWE-770). Red Hat's advisory for Multicluster Global Hub 1.3.4 includes security updates that address this issue. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

The vulnerability can cause denial of service by exhausting memory resources on the Tempo service, potentially making the service unavailable. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction, making it a significant availability risk.

Mitigation can be achieved by configuring the max_result_limit parameter in the Tempo search configuration to limit the size of queries, for example setting it to 262144. Alternatively, automatically restarting the Tempo service can help recover from resource exhaustion. Red Hat has released security updates in Multicluster Global Hub version 1.3.4 that include fixes for this vulnerability. Users should apply these updates to remediate the issue.