CVE-2026-19475: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/grafanato a version that resolves this vulnerability.Fixed in 12.4.14-r0
Event History
Frequently Asked Questions
What level of access is required to trigger the denial of service?
An attacker must be authenticated and have permission to query a SQL data source. No user interaction is required.
Which deployments are exposed to this issue?
Deployments using Grafana with Microsoft SQL Server, PostgreSQL, or MySQL data sources are affected when a user can query those data sources.