Executive brief
Grafana is a widely-used monitoring and visualization platform. An authenticated user who has permission to query SQL databases can inject a macro command that bypasses previous security fixes and causes the Grafana server to consume excessive memory and crash, resulting in service downtime for all users relying on that instance.
Technical details
This is a denial-of-service vulnerability in Grafana's SQL data source plugin, specifically in the macro parsing logic. An authenticated attacker with query permissions can inject the $__timeGroup macro through a WHERE clause; Grafana's regex-based parser fails to properly sanitize this input, allowing the malicious macro to be evaluated. When processed, the macro causes uncontrolled memory allocation, leading to out-of-memory (OOM) conditions that crash the Grafana server process. The vulnerability affects PostgreSQL, MySQL, and Microsoft SQL Server data sources. Authentication is required, but exploitation requires only basic query permissions on a SQL data source.
Affected products
- Grafana PostgreSQL Datasource <11.6.0, >=12.4.10, <13.0.0, >=13.0.8, <13.1.0, >=13.1.5
- Grafana MySQL Datasource
- Grafana Microsoft SQL Server Datasource
Timeline
- 2026-09-02: disclosed