Grafana: Viewer can crash the server with a SQL Expression that casts to a huge BINARY length

Impact

Any user with the Viewer role can crash Grafana with one SQL Expression query that casts a value to a very large BINARY length, which makes the server allocate unbounded memory. Grafana is often the main view of GPU fleet health (DCGM exporters, node and job metrics), so a low-privilege user can blind operators and trigger repeated restarts. There is no data exposure. The impact is availability.

Who can reach it

An authenticated user with the Viewer role on the Grafana instance, over the network.

What to do

Upgrade Grafana to a fixed release listed in the Grafana advisory and restart the Grafana server. The record names no fixed version. Until you upgrade, check who holds Viewer access on internet-facing or shared instances.

References

Related entries

• Grafana Git Sync: path traversal lets an Editor delete or move files outside the repository pathCVE-2026-110992 · Grafana OSS / Enterprise (Git Sync provisioning)Medium
• Apache Airflow: asset API reveals IDs of Dags the caller is not allowed to readCVE-2026-111454 · Apache Airflow (asset API endpoints)Medium
• Jenkins: symlink following during item rename discloses arbitrary controller filesCVE-2026-117615 · Jenkins core (item rename directory copy, symlink following)Medium
• ansible-pylibssh / ansible.netcommon: changed SSH host keys silently accepted when auto-add is onCVE-2026-126641 · ansible-pylibssh and ansible.netcommon libssh connection plugin (host key verification)Medium
• AWX: template admin can attach another user's webhook token and have it sent to a destination they controlCVE-2026-126642 · Red Hat Ansible Automation Platform / AWX (job template webhook credentials)Medium
• AAP Gateway Operator: resource-server secret copied in plaintext into the AutomationController custom resourceCVE-2026-126643 · Red Hat Ansible Automation Platform Gateway Operator (AutomationController reconciliation)Medium