CVE-2026-19475

An authenticated user with permission to query a SQL datasource (Microsoft SQL Server, PostgreSQL, or MySQL) could bypass the fix for CVE-2026-33375 by injecting the $__timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro triggers unbounded memory consumption, crashing the Grafana server process and causing a denial of service. The request can be repeated once the instance restarts.

A moderate-impact denial of service vulnerability was found in Grafana. An authenticated user with permission to query a SQL datasource (Microsoft SQL Server, PostgreSQL, or MySQL) can bypass the fix for CVE-2026-33375 by injecting the $__timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro triggers unbounded memory consumption that crashes the Grafana server process, and the request can be repeated once the instance restarts. Red Hat Product Security rated this flaw Moderate, consistent with the upstream CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The grafana package shipped in Red Hat Enterprise Linux 10.3 and 10.4, Red Hat In-Vehicle OS 2.1, and the Grafana container images in Red Hat Ceph Storage, Red Hat Advanced Cluster Management for Kubernetes, and Multicluster Global Hub are affected; fixes for these product streams are currently deferred, and the residual risk is that an authenticated user with SQL datasource query permissions can crash the Grafana process and repeat the attack after restart. Earlier grafana versions shipped in Red Hat Enterprise Linux 7, 8, 9, and 10.0 through 10.2 are not affected because the vulnerable macro-parsing code was introduced in the upstream Grafana 11.6.x series. The Grafana images in Red Hat Hardened Images were investigated by that business unit and determined not affected because the affected component is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to a fixed Grafana release: 12.4.10 or later (12.4.x), 13.0.8 or later (13.0.x), or 13.1.5 or later (13.1.x and newer, includes 13.2.0+). Versions prior to 11.6.0 predate the vulnerable code path and are not affected.