CVE-2026-19475: Grafana SQL Data Source DOS Vulnerability

CVE-2026-19475 Overview

CVE-2026-19475 is a denial of service vulnerability in Grafana affecting the SQL data source query pipeline. An authenticated user with permission to query a SQL data source can inject the timeGroup macro through a WHERE clause. Grafana's regex-based macro parsing fails to reject the injected macro, and evaluating it triggers uncontrolled memory consumption that can terminate the Grafana server process. The vulnerability bypasses the prior fix for CVE-2026-33375. Affected data sources include Microsoft SQL Server, PostgreSQL, and MySQL. The weakness is categorized as [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
An authenticated low-privilege user can crash the Grafana server process, disrupting monitoring and observability workflows for all tenants sharing the instance.

Affected Products

Grafana instances using Microsoft SQL Server data sources
Grafana instances using PostgreSQL data sources
Grafana instances using MySQL data sources

Discovery Timeline

2026-09-02 - CVE-2026-19475 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19475

Vulnerability Analysis

Grafana exposes template macros such as timeGroup that expand into SQL fragments during query processing. The engine relies on regex-based parsing to locate and validate macro invocations before evaluation. A prior fix for CVE-2026-33375 restricted where macros could appear, but the sanitization does not cover macro tokens embedded inside a user-supplied WHERE clause.

When the timeGroup macro is injected through the WHERE clause, the parser accepts it and passes it to the evaluator. The evaluation path allocates memory proportional to the macro's expanded time buckets. An attacker can craft parameters that force the evaluator to allocate excessive memory, exhausting the process heap.

The result is process termination and denial of service across the Grafana instance. Any dashboards, alerts, and API consumers backed by the affected instance become unavailable until the process restarts.

Root Cause

The root cause is incomplete input validation in the SQL macro parser. Regex-based macro detection does not reject macros injected through query fragments that users can influence, such as the WHERE clause. Macro expansion runs without bounds on the memory the expansion may consume.

Attack Vector

Exploitation requires an authenticated Grafana account with permission to query one of the affected SQL data sources. The attacker submits a query containing a WHERE clause with an embedded timeGroup macro invocation. Grafana parses the macro, evaluates it, and consumes memory until the process terminates. No user interaction beyond query submission is required.

// No verified public exploit code is available.
// See the Grafana Security Advisory for technical details:
// https://grafana.com/security/security-advisories/cve-2026-19475

Detection Methods for CVE-2026-19475

Indicators of Compromise

Unexpected termination or restart of the Grafana server process, especially correlated with SQL data source query activity.
Sudden spikes in resident memory for the grafana-server process preceding a crash.
SQL data source query logs containing the string $__timeGroup or timeGroup( inside WHERE clauses.

Detection Strategies

Inspect Grafana query and audit logs for authenticated users submitting queries that include the timeGroup macro in non-SELECT positions.
Correlate Grafana process crash events with the last query executed by the associated user session.
Alert on repeated Grafana process restarts within short time windows on hosts running SQL data sources.

Monitoring Recommendations

Monitor grafana-server process memory and OOM-killer events in host telemetry.
Ingest Grafana access and query logs into a centralized log platform and baseline macro usage patterns per user.
Track availability of Grafana HTTP endpoints and alert on service disruption.

How to Mitigate CVE-2026-19475

Immediate Actions Required

Upgrade Grafana to the patched version identified in the Grafana Security Advisory CVE-2026-19475.
Audit users with query permissions on Microsoft SQL Server, PostgreSQL, and MySQL data sources and remove unnecessary access.
Review recent query logs for evidence of timeGroup macro abuse in WHERE clauses.

Patch Information

Grafana Labs has published a fix in the security advisory referenced above. Apply the vendor-supplied update for your Grafana release train. Verify the running version after upgrade and restart the service to load the patched binary.

Workarounds

Restrict SQL data source query permissions to trusted users until patching is complete.
Place Grafana behind a reverse proxy that inspects and blocks query payloads containing $__timeGroup in WHERE clauses.
Run Grafana with process-level resource limits (for example, systemd MemoryMax) to contain memory exhaustion and enable rapid restart.

bash

# Example systemd override to cap Grafana memory and auto-restart on failure
# /etc/systemd/system/grafana-server.service.d/override.conf
[Service]
MemoryMax=2G
Restart=always
RestartSec=5s