CVE-2026-19475: CVE Record
Published Sep 2, 2026
·Updated
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Affected Software
4 affected components
Grafana Grafana
Microsoft SQL Server
PostgreSQL
MySQL
Event History
Sep 2, 2026
CVE Published
via MITRE·03:56 PM
Data Sourced
via MITRE·03:56 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access is required to trigger the denial of service?
An attacker must be authenticated and have permission to query a SQL data source. No user interaction is required.
2
Which deployments are exposed to this issue?
Deployments using Grafana with Microsoft SQL Server, PostgreSQL, or MySQL data sources are affected when a user can query those data sources.