CVE-2026-33378: SQL Datasource DoS Vulnerability

CVE-2026-33378 Overview

CVE-2026-33378 is a denial of service vulnerability in Grafana affecting SQL data source integrations. An authenticated user can abuse the $__timeGroup macro to exhaust server memory and trigger an out-of-memory (OOM) condition. The attack requires a configured SQL data source and approximately 30 minutes of sustained activity to crash the server. Deployments configured with auto-restart experience minimal operational impact. Grafana published the advisory through its security advisory portal.

Critical Impact
An authenticated attacker can force the Grafana server into an OOM state, disrupting dashboard availability and query services until the process restarts.

Affected Products

Grafana instances with SQL-based data sources configured
Grafana deployments exposing the $__timeGroup query macro to authenticated users
Self-hosted Grafana servers without process auto-restart supervision

Discovery Timeline

2026-05-13 - CVE CVE-2026-33378 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-33378

Vulnerability Analysis

The vulnerability resides in Grafana's $__timeGroup macro handling within SQL data source queries. The macro expands time-bucketing expressions used in dashboard panels for time-series aggregation. When an attacker submits crafted parameters to the macro, the server allocates memory disproportionate to the request size, accumulating allocations until the process exhausts available memory.

The attack requires authenticated access with permission to issue queries against a SQL data source. Because the operation is processed server-side during query rendering, the cost is borne by the Grafana process rather than the backing database. Sustained submission of malicious queries gradually depletes heap memory, eventually terminating the process.

This class of issue maps to resource exhaustion and algorithmic complexity weaknesses [CWE-400]. The impact is limited to availability, with no confidentiality or integrity compromise, consistent with the advisory's scope.

Root Cause

The $__timeGroup macro lacks adequate bounds on the expansion or aggregation work it performs. Insufficient validation of macro parameters permits operations that consume memory at a rate that the process cannot sustain, leading to an OOM termination.

Attack Vector

An authenticated user with query access submits repeated requests using a malicious $__timeGroup invocation through a SQL data source. The attack is network-reachable and requires low privileges. Exploitation is slow, taking up to half an hour to crash the server, which limits stealth but does not prevent disruption. See the Grafana Security Advisory CVE-2026-33378 for vendor-confirmed technical details.

Detection Methods for CVE-2026-33378

Indicators of Compromise

Sustained growth in Grafana server resident memory without proportional dashboard or user growth
Repeated panel queries from a single authenticated session referencing $__timeGroup against SQL data sources
Grafana process restarts logged by systemd, Kubernetes, or supervisor with OOM exit codes
Kernel oom-killer entries targeting the Grafana process in system logs

Detection Strategies

Monitor Grafana audit logs for query volume anomalies tied to individual users and SQL data sources
Correlate process memory metrics with query rates per user to surface slow-burn resource abuse
Alert on query strings containing $__timeGroup with unusual interval parameters or high call frequency

Monitoring Recommendations

Ingest Grafana access and query logs into a centralized analytics platform for behavioral baselining
Track container or host OOM events and tie them to preceding query activity
Configure alerts on Grafana process restarts and abnormal memory utilization trends

How to Mitigate CVE-2026-33378

Immediate Actions Required

Upgrade Grafana to the fixed version listed in the Grafana Security Advisory CVE-2026-33378
Audit which users hold query permissions on SQL data sources and remove unnecessary access
Ensure Grafana runs under a supervisor that auto-restarts the process on OOM termination

Patch Information

Grafana published patched versions in the security advisory. Review the Grafana Security Advisory CVE-2026-33378 for the exact fixed releases and upgrade procedures applicable to your deployment.

Workarounds

Restrict SQL data source access to trusted teams until the patch is applied
Run Grafana under systemd or Kubernetes with restart policies configured to recover quickly from OOM events
Apply memory limits and rate limiting at a reverse proxy in front of Grafana to constrain abusive query patterns

bash

# Configuration example: systemd auto-restart for Grafana
# /etc/systemd/system/grafana-server.service.d/override.conf
[Service]
Restart=always
RestartSec=5
MemoryMax=2G