CVE-2026-19475
Medium
Description
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
SeverityMedium
CVSS6.5
Exploit probability—
Product
PostgreSQL Datasource
PublishedSep 2, 2026
First seenSep 2, 2026
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Grafana PostgreSQL Datasource | 13.0.0 ≤ v ≤ 13.0.1 | — |
| Grafana MySQL Datasource | 13.0.0 ≤ v ≤ 13.0.2 | — |
| Grafana Grafana OSS | 11.6.0 ≤ v ≤ 11.6.16, 12.0.0 ≤ v ≤ 12.0.10, 12.1.0 ≤ v ≤ 12.1.10, 12.2.0 ≤ v ≤ 12.2.10, 12.3.0 ≤ v ≤ 12.3.11, 12.4.0 ≤ v ≤ 12.4.9, 13.0.0 ≤ v ≤ 13.0.7, 13.1.0 ≤ v ≤ 13.1.4 | — |
| Grafana Microsoft SQL Server Datasource | 13.0.0 ≤ v ≤ 13.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.