Description (CNA)
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Grafana / PostgreSQL Datasource | affected 13.0.0 through 13.0.1 |
| Grafana / MySQL Datasource | affected 13.0.0 through 13.0.2 |
| Grafana / Grafana OSS | affected 11.6.0 through 11.6.16; affected 12.0.0 through 12.0.10; affected 12.1.0 through 12.1.10; affected 12.2.0 through 12.2.10; affected 12.3.0 through 12.3.11; affected 12.4.0 through 12.4.9; affected 13.0.0 through 13.0.7; affected 13.1.0 through 13.1.4 |
| Grafana / Microsoft SQL Server Datasource | affected 13.0.0 through 13.0.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.