Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server process

Impact

Any user allowed to query a Microsoft SQL Server, PostgreSQL or MySQL data source can smuggle the timeGroup macro in through a WHERE clause, which Grafana's regex-based macro parsing fails to reject - bypassing the fix shipped for CVE-2026-33375. Evaluating the injected macro consumes memory without bound until the Grafana process is terminated, taking every dashboard and Grafana-managed alert rule down for all users at once. On a GPU fleet that means losing DCGM, thermal and job telemetry plus the alerting path exactly when operators need it, though the GPUs and workloads themselves keep running. Availability only - the advisory claims no data access or integrity impact.

Who can reach it

Authenticated Grafana user holding query permission on any SQL data source; a Viewer with Explore access is often enough. No administrator rights required.

What to do

Upgrade to the fixed Grafana release for CVE-2026-19475 - the earlier CVE-2026-33375 fix does not cover this path, so an instance patched only for that one is still exposed. Cost is a Grafana service restart, no fleet maintenance. Until then, narrowing who holds query permission on the SQL data sources reduces who can trigger it, and running Grafana under a memory limit with automatic restart turns a sustained outage into a brief one.

References

Related entries

• Grafana: unbounded request body on the Prometheus rule conversion API crashes the server via out-of-memoryCVE-2026-33374 · Grafana Prometheus rule conversion APIMedium
• lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
• Apache Airflow: Bulk Variables API skips key-based redaction, returning JSON variable secrets in cleartextCVE-2026-48828 · Apache Airflow (Bulk Variables API, secrets masker key-based redaction)Medium
• Apache Airflow: Config API exposes secrets-backend kwargs overrides unmasked, leaking Vault credentialsCVE-2026-48892 · Apache Airflow (Config API, per-key secrets-backend environment overrides)Medium
• Apache Airflow: Dag source endpoint returns the whole file, exposing co-located Dags the caller cannot readCVE-2026-49296 · Apache Airflow (Dag source endpoint, GET /api/v2/dagSources/{dag_id})Medium
• Apache Airflow: task-instance API returns deferred trigger kwargs unmasked, exposing secrets passed to triggersCVE-2026-49487 · Apache Airflow (REST API task-instance endpoints, deferred trigger kwargs)Medium