CVE-2026-19475

Summary

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

Affected Software

VendorProductVersion RangeStatus
GrafanaPostgreSQL Datasource13.0.0 <= 13.0.1affected
GrafanaMySQL Datasource13.0.0 <= 13.0.2affected
GrafanaGrafana OSS11.6.0 <= 11.6.16affected
GrafanaGrafana OSS12.0.0 <= 12.0.10affected
GrafanaGrafana OSS12.1.0 <= 12.1.10affected
GrafanaGrafana OSS12.2.0 <= 12.2.10affected
GrafanaGrafana OSS12.3.0 <= 12.3.11affected
GrafanaGrafana OSS12.4.0 <= 12.4.9affected
GrafanaGrafana OSS13.0.0 <= 13.0.7affected
GrafanaGrafana OSS13.1.0 <= 13.1.4affected
GrafanaMicrosoft SQL Server Datasource13.0.0 <= 13.0.1affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References