CVE-2026-19475mediumCWE-400

CVE-2026-19475: falha de média gravidade em Grafana OSS

SQL Data Source Plugin: OOM DoS via $__timeGroup macro

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Grafana OSS+ Monitorar Microsoft SQL Server Datasource

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Grafana · Grafana OSSGrafana · Microsoft SQL Server DatasourceGrafana · MySQL DatasourceGrafana · PostgreSQL Datasource
CVEs relacionadas — Grafana OSS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-15815HIGHCVE-2026-15815 CVE RecordEPSS 0.7%CVE-2026-33375MEDIUMGrafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoSEPSS 0.5%CVE-2026-42129HIGHPath traversal in the Loki data source pluginEPSS 0.4%CVE-2026-42127HIGHPre-authentication denial of service in the public dashboard query endpointEPSS 0.4%CVE-2026-8609MEDIUMPre-authentication denial of service via the OAuth login routeEPSS 0.4%CVE-2026-33382HIGHDenial of service via unbounded request body sizeEPSS 0.4%