# CVE-2026-19475: Grafana SQL Data Source Plugin denial of service via $__timeGroup macro

Source: https://junglewise.ai/threats/cve-2026-19475-grafana-sql-data-source-plugin-denial-of-service-via-timegroup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19475 · Severity: medium · CVSS 6.5 · Published 2026-09-02

Grafana is a widely-used monitoring and visualization platform. An authenticated user who has permission to query SQL databases can inject a macro command that bypasses previous security fixes and causes the Grafana server to consume excessive memory and crash, resulting in service downtime for all users relying on that instance.

Vendors: [Grafana](https://junglewise.ai/threats/vendors/grafana).

## Quick answers

**Is CVE-2026-19475 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19475 being exploited in the wild.

**How severe is CVE-2026-19475?** Medium severity, with a CVSS score of 6.5, published 2 September 2026.

**Which products and versions are affected?** Grafana PostgreSQL Datasource <11.6.0, >=12.4.10, <13.0.0, >=13.0.8, <13.1.0, >=13.1.5.

**Is there a fix for CVE-2026-19475?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19475 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-19475?** Check whether you run Grafana Microsoft SQL Server Datasource, Grafana MySQL Datasource or Grafana PostgreSQL Datasource at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a denial-of-service vulnerability in Grafana's SQL data source plugin, specifically in the macro parsing logic. An authenticated attacker with query permissions can inject the $__timeGroup macro through a WHERE clause; Grafana's regex-based parser fails to properly sanitize this input, allowing the malicious macro to be evaluated. When processed, the macro causes uncontrolled memory allocation, leading to out-of-memory (OOM) conditions that crash the Grafana server process. The vulnerability affects PostgreSQL, MySQL, and Microsoft SQL Server data sources. Authentication is required, but exploitation requires only basic query permissions on a SQL data source.

## Affected products

- Grafana PostgreSQL Datasource <11.6.0, >=12.4.10, <13.0.0, >=13.0.8, <13.1.0, >=13.1.5
- Grafana MySQL Datasource
- Grafana Microsoft SQL Server Datasource

## Timeline

- 2026-09-02: disclosed

## References

- [https://grafana.com/security/security-advisories/cve-2026-19475](https://grafana.com/security/security-advisories/cve-2026-19475)