CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro
Authenticated users can cause a denial of service in Grafana by injecting a timeGroup macro into SQL queries, leading to uncontrolled memory consumption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19475?
CVE-2026-19475 is a medium-severity denial of service vulnerability in Grafana OSS, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Weakness: CWE-400
Which versions are affected by CVE-2026-19475?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 11.6.0 | 12.4.10, 13.0.8, 13.1.5 |
How do I fix CVE-2026-19475?
Upgrade grafana to a fixed version for your release line: 12.4.10, 13.0.8 or 13.1.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-19475 being exploited?
There is no known exploitation of CVE-2026-19475 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-19475, GHSA-f7qf-p234-rj62, MINI-22g9-2rvq-fpjp, MINI-2wqj-63p3-hrvg, MINI-58cg-j6w8-xjmf, MINI-65fj-9524-fv76 and 12 more.