Grafana Denial-of-Service via SQL Macro Injection: CVE-2026-19475 September 2026

Grafana Denial-of-Service via SQL Macro Injection
CVE-2026-19475 Published on September 2, 2026

SQL Data Source Plugin: OOM DoS via $__timeGroup macro
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2026-19475 has been classified to as a Resource Exhaustion vulnerability or weakness.

Products Associated with CVE-2026-19475

Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.

Affected Versions

Version 13.0.0, <= 13.0.1 is affected.

Version 13.0.0, <= 13.0.2 is affected.

Version 11.6.0, <= 11.6.16 is affected.

Version 12.0.0, <= 12.0.10 is affected.

Version 12.1.0, <= 12.1.10 is affected.

Version 12.2.0, <= 12.2.10 is affected.

Version 12.3.0, <= 12.3.11 is affected.

Version 12.4.0, <= 12.4.9 is affected.

Version 13.0.0, <= 13.0.7 is affected.