Medium 6.5Published Sep 2, 2026

CVE-2026-19475SQL Data Source Plugin: OOM DoS via $__timeGroup macro

Updated under an hour ago (Oct 26, 2026, 8:20 PM ET)

Does this affect you?

It affects Grafana PostgreSQL Datasource and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Grafana PostgreSQL Datasource

Exploited in the last 30 days

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GRAFANA
NVD analysis: Awaiting Analysis
Record last updated: Sep 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Grafana PostgreSQL Datasource grafana:postgresql_datasource (from the name)	from 13.0.0 through 13.0.1	CNA record
Grafana MySQL Datasource grafana:mysql_datasource (from the name)	from 13.0.0 through 13.0.2	CNA record
Grafana Grafana OSS grafana:oss (from the name)	from 11.6.0 through 11.6.16; from 12.0.0 through 12.0.10; from 12.1.0 through 12.1.10; from 12.2.0 through 12.2.10; from 12.3.0 through 12.3.11; from 12.4.0 through 12.4.9; from 13.0.0 through 13.0.7; from 13.1.0 through 13.1.4	CNA record
Grafana Microsoft SQL Server Datasource grafana:microsoft_sql_server_datasource (from the name)	from 13.0.0 through 13.0.1	CNA record

References

References

https://grafana.com/security/security-advisories/cve-2026-19475	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.