What’s Vulnerable › Vulnerabilities
CVE-2026-19475: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-03
- Weakness: CWE-400
Description
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Affected products
- Grafana: from 11.6.0 through 11.6.16; from 12.0.0 through 12.0.10; from 12.1.0 through 12.1.10; from 12.2.0 through 12.2.10; from 12.3.0 through 12.3.11; from 12.4.0 through 12.4.9
- Grafana Microsoft SQL Server Datasource: from 13.0.0 through 13.0.1
- Grafana MySQL Datasource: from 13.0.0 through 13.0.2
- Grafana PostgreSQL Datasource: from 13.0.0 through 13.0.1
References
Get alerted when CVE-2026-19475 or the next vulnerability affects your stack