Vulnerability · Published Sep 2, 2026 · Assigned by GRAFANA

CVE-2026-19475SQL Data Source Plugin: OOM DoS via $__timeGroup macro

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in Grafana OSS from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	grafana	12.4.14-r0	ALPINE-CVE-2026-19475

Affected products (as reported)

Vendor	Product	Versions
Grafana	PostgreSQL Datasource	13.0.0 – through 13.0.1
Grafana	MySQL Datasource	13.0.0 – through 13.0.2
Grafana	Grafana OSS	11.6.0 – through 11.6.1612.0.0 – through 12.0.1012.1.0 – through 12.1.1012.2.0 – through 12.2.1012.3.0 – through 12.3.1112.4.0 – through 12.4.913.0.0 – through 13.0.713.1.0 – through 13.1.4
Grafana	Microsoft SQL Server Datasource	13.0.0 – through 13.0.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://grafana.com/security/security-advisories/cve-2026-19475 vendor-advisory