CVE-2026-27878

Medium

Advisory

Published 19 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 68; of 17,781 indexed, latest versions
Container images: 44; deployed by those charts
Fix available: 1 of 1; affected package

Grafana Tempo vulnerable to an out-of-memory crash

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 44 images.

Affected package	Affected versions	Fixed in	Images
github.com/grafana/tempogolang	v0.0.0-20250806200423-6b92615861c3, v0.0.0-20251008140505-607c7fb69662, v0.0.0-20260413105002-54b109f75993, v0.0.0-20260813170847-f0f3ed59197b+6 more	1.5.1-0.20260303204923-b13f74291d48	44

OSV records: GHSA-6xff-cpcq-vpw2
Also known as: GO-2026-6325

Charts affected

68 by stars

Chart

Latest

Affected images

Radar Score

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

5,411

vm-standaloneot-container-kit

0.0.4

1 of 6 See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

3,378

pax-prometheuspaxtecnologia

0.7.0

1 of 8 See more

pax-prometheus paxtecnologia 0.7.0

1 of the 8 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :13.2.1-distroless	3600073f45a9	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

1,826

archive-analysispcp-helm-charts

1.0.1

1 of 1 See more

archive-analysis pcp-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
ghcr.io/performancecopilot/archive-analysis :latest	8de11e2363fc	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

1,326

loki-stackpyalive-cdmswebapp

2.6.5

1 of 4 See more

loki-stack pyalive-cdmswebapp 2.6.5

1 of the 4 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

6,525

kubecostradar-base

1.0.0

1 of 7 See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :11.4.0	d8ea37798ccc	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

9,355

radar-grafanaradar-base

0.1.4

1 of 2 See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :11.6.0	62d2b9d20a19	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

1,667

speedtestsantisbon

0.1.0

1 of 3 See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

12,668

grafanasb-helm-charts

0.4.0

1 of 1 See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.2	2ebef928d7e5	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

1,795

temposb-helm-charts

0.4.0

1 of 1 See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/tempo :2.9.0	65a578975943	github.com/grafana/tempo@v0.0.0-20251008140505-607c7fb69662	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

923

ccx-monitoringseveralnines

0.6.21

1 of 7 See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.1	2175aaa91c96	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

7,708

cost-analyzersoftonic

2.5.5

1 of 6 See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.2	8b37a2f028f1	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

7,901

kube-prometheus-stacksoftonic

81.5.1

1 of 6 See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.2	ba93c9d192e5	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

4,974

stunner-prometheusstunner

0.2.1

1 of 4 See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

3,025

todolist-charttodolist-chart

0.1.7

1 of 10 See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

6,973

truefoundry-monitoringtruefoundry

0.1.6

1 of 8 See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.0	70d9599b186c	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

4,526

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

9,381

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-27878.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48

Open the chart page →

878

Container images carrying it

44 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :latest	f772d434e8fa	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	12
grafana/grafana :13.2.1-distroless	3600073f45a9	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	5
grafana/tempo :2.9.0	65a578975943	github.com/grafana/tempo@v0.0.0-20251008140505-607c7fb69662	1.5.1-0.20260303204923-b13f74291d48	4
grafana/grafana :11.0.0	0dc5a246ab16	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	3
grafana/grafana :11.3.0	a0f881232a6f	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48	3
grafana/grafana :11.1.0	079600c9517b	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	2
grafana/grafana :12.3.1	2175aaa91c96	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	2
grafana/grafana :11.1.4	886b56d5534e	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	2
grafana/grafana :12.3.3	9e1e77ade304	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	2
grafana/grafana :11.4.0	d8ea37798ccc	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48	2
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	2
grafana/tempo :2.10.8	f0561deb1c68	github.com/grafana/tempo@v0.0.0-20260813170847-f0f3ed59197b	1.5.1-0.20260303204923-b13f74291d48	2
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48	1
defactops/defactops-ui :1.0.16	825cdf9ba706	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :10.1.5	0679e877ba20	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :13.2.0-distroless	08e6ab6d67a5	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :13.0.1	0f86bada30d6	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :10.1.1	1b9ca4bbc4a2	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.2.2	2ebef928d7e5	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.2.1	35c41e0fd029	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :11.2.2-security-01	464eac539793	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :11.5.1	5781759b3d27	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :11.6.0	62d2b9d20a19	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :10.2.3	6b5b37eb35bb	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.3.0	70d9599b186c	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.2.0	74144189b384	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :10.3.3	8640e5038e83	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :11.5.2	8b37a2f028f1	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.1.1	a1701c218024	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :10.4.19	a9043254ba16	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :11.1.3	b23b588cf7cb	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.0.2	b5b59bfc7561	github.com/grafana/tempo@v1.5.1-0.20241001135150-ed943d7a56b2	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :12.3.2	ba93c9d192e5	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :10.4.0	f9811e4e687f	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
grafana/grafana :11.3.1	fa801ab6e1ae	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/grafana/tempo@v0.0.0-20250806200423-6b92615861c3	1.5.1-0.20260303204923-b13f74291d48	1
grafana/tempo :3.0.3	0296560ac66f	github.com/grafana/tempo@v0.0.0-20260813195312-1900ed7bb5ca	1.5.1-0.20260303204923-b13f74291d48	1
percona/pmm-server :3.9.1	003f9c25f842	github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b	1.5.1-0.20260303204923-b13f74291d48	1
sky5367/locust-plugins-grafana :latest	d51bf68d4b26	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
ghcr.io/performancecopilot/archive-analysis :latest	8de11e2363fc	github.com/grafana/tempo@v1.5.1-0.20230524121406-1dc1bfe7085b	1.5.1-0.20260303204923-b13f74291d48	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/grafana/tempo@v1.5.1-0.20240604192202-01f4bc8ac2d1	1.5.1-0.20260303204923-b13f74291d48	1
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	1.5.1-0.20260303204923-b13f74291d48	1
quay.io/opstree/tempo :2.10.4-debian13	cb734024b3fd	github.com/grafana/tempo@v0.0.0-20260413105002-54b109f75993	1.5.1-0.20260303204923-b13f74291d48	1