CVE-2026-19475
published 2026-09-02CVE-2026-19475: An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.40%
32.9th percentile
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_oss | 11.6.0 – 11.6.16 | — |
| grafana | grafana_oss | 12.0.0 – 12.0.10 | — |
| grafana | grafana_oss | 12.1.0 – 12.1.10 | — |
| grafana | grafana_oss | 12.2.0 – 12.2.10 | — |
| grafana | grafana_oss | 12.3.0 – 12.3.11 | — |
| grafana | grafana_oss | 12.4.0 – 12.4.9 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.7 | — |
| grafana | grafana_oss | 13.1.0 – 13.1.4 | — |
| grafana | microsoft_sql_server_datasource | 13.0.0 – 13.0.1 | — |
| grafana | mysql_datasource | 13.0.0 – 13.0.2 | — |
| grafana | postgresql_datasource | 13.0.0 – 13.0.1 | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
| rhceph | rhceph-5-dashboard-rhel8 | — | — |
| rhceph | rhceph-6-dashboard-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
vendor_redhat·2026-09-03·CVSS 6.5
CVE-2026-19475 [MEDIUM] CWE-400 grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
An authenticated user with permission to query a SQL datasource (Microsoft SQL Server, PostgreSQL, or MySQL) could bypass the fix for CVE-2026-33375 by injecting the $__timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating th
GHSA
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsin
ghsa_unreviewed·2026-09-02·CVSS 6.5
CVE-2026-19475 [MEDIUM] CWE-400 An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsin
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
VulDB
Grafana Microsoft SQL Server/MySQL/PostgreSQL Macro Parsing memory allocation (EUVD-2026-70104)
vuldb·2026-09-02·CVSS 6.5
CVE-2026-19475 [MEDIUM] Grafana Microsoft SQL Server/MySQL/PostgreSQL Macro Parsing memory allocation (EUVD-2026-70104)
A vulnerability was found in Grafana Microsoft SQL Server, MySQL and PostgreSQL. It has been declared as problematic. This affects an unknown function of the component Macro Parsing. The manipulation results in uncontrolled memory allocation.
This vulnerability was named CVE-2026-19475. The attack may be performed from remote. There is no available exploit.
No detection rules found.
No public exploits indexed.
2026-09-02
Published