Database/Control plane, storage & DevOps
Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server process
Impact
Any user allowed to query a Microsoft SQL Server, PostgreSQL or MySQL data source can smuggle the timeGroup macro in through a WHERE clause, which Grafana's regex-based macro parsing fails to reject - bypassing the fix shipped for CVE-2026-33375. Evaluating the injected macro consumes memory without bound until the Grafana process is terminated, taking every dashboard and Grafana-managed alert rule down for all users at once. On a GPU fleet that means losing DCGM, thermal and job telemetry plus the alerting path exactly when operators need it, though the GPUs and workloads themselves keep running. Availability only - the advisory claims no data access or integrity impact.
Who can reach it
Authenticated Grafana user holding query permission on any SQL data source; a Viewer with Explore access is often enough. No administrator rights required.
What to do
Upgrade to the fixed Grafana release for CVE-2026-19475 - the earlier CVE-2026-33375 fix does not cover this path, so an instance patched only for that one is still exposed. Cost is a Grafana service restart, no fleet maintenance. Until then, narrowing who holds query permission on the SQL data sources reduces who can trigger it, and running Grafana under a memory limit with automatic restart turns a sustained outage into a brief one.
References
Related entries
- lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
- Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
- Apache Airflow: JSON Variable secrets shown in cleartext in the Rendered Templates viewCVE-2026-59244 · Apache Airflow secrets masker (Rendered Templates view, var.json dict values)Medium
- GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium
- Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
- Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL andNCVD-2024-010-ceph-python-bindings-imap4-ssl-s · Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.