BIT-grafana-2026-19475

    Dashboard / Vulnerabilities / BIT-grafana-2026-19475

    BIT-grafana-2026-19475

    Published: 8 Sept 2026Last Modified: 8 Sept 2026

    Summary: SQL Data Source Plugin: OOM DoS via $__timeGroup macro

    Details: An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

    References: https://grafana.com/security/security-advisories/cve-2026-19475, https://nvd.nist.gov/vuln/detail/CVE-2026-19475

    Affected packages

    Package

    Name: grafana

    Purl: pkg:bitnami/grafana

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 11.6.0
    Fixed -12.4.10

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-grafana-2026-19475 | CVE-DB