StackRadar

CVE-2026-21728

High

Advisory

Published 24 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
81
of 17,781 indexed, latest versions
Container images
47
deployed by those charts
Fix available
1 of 1
affected package

Grafana Tempo has an Uncontrolled Resource Consumption issue

Carried by container images the latest versions of 81 of 17,781 indexed charts deploy, on 47 images.

Affected packageAffected versionsFixed inImages
github.com/grafana/tempogolangv1.5.1-0.20230524121406-1dc1bfe7085b, v1.5.1-0.20240604192202-01f4bc8ac2d1, v1.5.1-0.20241001135150-ed943d7a56b2, v1.5.1-0.20250529124718-87c2dc380cec+5 more2.8.447
OSV records
GHSA-p4r4-xvrq-gvmcGO-2026-5528

Charts affected

81 by stars
ChartLatestAffected imagesRadar Score
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:10.4.0f9811e4e687f
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4

Open the chart page →

7,309
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

720
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

4,132
grafananodepulse7.1.01 of 1See more

grafana nodepulse 7.1.0

1 of the 1 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:10.2.36b5b37eb35bb
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4

Open the chart page →

2,966
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

17,070
pgaot-container-kit1.0.31 of 6See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:11.1.0079600c9517b
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4

Open the chart page →

5,137
vmot-container-kit0.0.31 of 7See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:11.1.4886b56d5534e
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4

Open the chart page →

5,411
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

3,378
pax-prometheuspaxtecnologia0.7.01 of 8See more

pax-prometheus paxtecnologia 0.7.0

1 of the 8 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

1,826
archive-analysispcp-helm-chartsVerified publisher1.0.11 of 1See more

archive-analysis pcp-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/performancecopilot/archive-analysis:latest8de11e2363fc
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4

Open the chart page →

1,326
loki-stackpyalive-cdmswebappVerified publisher2.6.51 of 4See more

loki-stack pyalive-cdmswebapp 2.6.5

1 of the 4 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

6,525
grafanaquench-grafanaVerified publisher0.0.121 of 1See more

grafana quench-grafana 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4

Open the chart page →

119
harbor-observabilityquench-harbor-observabilityVerified publisher0.0.101 of 2See more

harbor-observability quench-harbor-observability 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4

Open the chart page →

182
lgtm-stackquench-lgtm-stackVerified publisher0.0.192 of 9See more

lgtm-stack quench-lgtm-stack 0.0.19

2 of the 9 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4
ghcr.io/quenchworks/images/tempodigest-pinned9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed

Open the chart page →

376
logging-stackquench-logging-stackVerified publisher0.0.121 of 3See more

logging-stack quench-logging-stack 0.0.12

1 of the 3 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4

Open the chart page →

190
observability-stackquench-observability-stackVerified publisher0.0.141 of 5See more

observability-stack quench-observability-stack 0.0.14

1 of the 5 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4

Open the chart page →

267
tempoquench-tempoVerified publisher0.0.151 of 1See more

tempo quench-tempo 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/tempodigest-pinned9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed

Open the chart page →

83
tracing-stackquench-tracing-stackVerified publisher0.0.92 of 3See more

tracing-stack quench-tracing-stack 0.0.9

2 of the 3 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4
ghcr.io/quenchworks/images/tempodigest-pinned9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed

Open the chart page →

283
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4

Open the chart page →

9,355
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4

Open the chart page →

1,667
speedtestsantisbon0.1.01 of 3See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

12,668
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

1,795
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

7,708
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4

Open the chart page →

7,901
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

4,974
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

3,025
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

6,973
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

4,526
victoria-metrics-k8s-stackwenerme0.92.11 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

1 of the 7 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4

Open the chart page →

1,889
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4

Open the chart page →

9,381
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-21728.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4

Open the chart page →

878

Container images carrying it

47 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:latestf772d434e8fa
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
12
ghcr.io/quenchworks/images/grafana3ccc56791c8a
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4
6
grafana/grafana:13.2.1-distroless3600073f45a9
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
5
grafana/grafana:13.1.0121a7a9ece6d
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4
4
grafana/grafana:11.0.00dc5a246ab16
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
3
grafana/grafana:13.1.17cb8c64c4d57
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4
3
grafana/grafana:11.3.0a0f881232a6f
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4
3
ghcr.io/quenchworks/images/tempo9e889ec33f96
github.com/grafana/tempo@v3.0.3
no fix listed
3
grafana/grafana:11.1.0079600c9517b
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
2
grafana/grafana:12.3.12175aaa91c96
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
2
grafana/grafana:11.1.4886b56d5534e
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
2
grafana/grafana:12.3.39e1e77ade304
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
2
grafana/grafana:11.4.0d8ea37798ccc
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4
2
grafana/grafana:12.4.1e932bd6ed0e0
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
2
grafana/tempo:2.5.0f0200a9bff6d
github.com/grafana/tempo@v2.5.0
2.8.4
2
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4
1
defactops/defactops-ui:1.0.16825cdf9ba706
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:10.1.50679e877ba20
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:13.2.0-distroless08e6ab6d67a5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:13.0.10f86bada30d6
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:10.1.11b9ca4bbc4a2
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:12.2.22ebef928d7e5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:12.2.135c41e0fd029
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:11.2.2-security-01464eac539793
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4
1
grafana/grafana:11.5.15781759b3d27
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4
1
grafana/grafana:11.6.062d2b9d20a19
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4
1
grafana/grafana:10.2.36b5b37eb35bb
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:12.3.070d9599b186c
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:12.2.074144189b384
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:10.3.38640e5038e83
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:11.5.28b37a2f028f1
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4
1
grafana/grafana:12.1.1a1701c218024
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:10.4.19a9043254ba16
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:13.1.3ab5cb380e3ff
github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0
2.8.4
1
grafana/grafana:11.1.3b23b588cf7cb
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:12.0.2b5b59bfc7561
github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2
2.8.4
1
grafana/grafana:12.3.2ba93c9d192e5
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/grafana:10.4.0f9811e4e687f
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
grafana/grafana:11.3.1fa801ab6e1ae
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4
1
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1
grafana/tempo:2.6.0f55a8a1937ff
github.com/grafana/tempo@v2.6.0
2.8.4
1
percona/pmm-server:3.9.1003f9c25f842
github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b
2.8.4
1
sky5367/locust-plugins-grafana:latestd51bf68d4b26
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
ghcr.io/performancecopilot/archive-analysis:latest8de11e2363fc
github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b
2.8.4
1
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1
2.8.4
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec
2.8.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.