CVE-2026-19475

6.5 Moyenne

Publiée le 02/09/2026 à 18:17 · Modifiée le 03/09/2026 à 18:37 · En attente d'analyse NVD · Source : security@grafana.com

Description

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

Traduire en français

Produits concernés

Grafana PostgreSQL Datasource
Grafana MySQL Datasource
Grafana OSS
Grafana Microsoft SQL Server Datasource

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security@grafana.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400

Références

https://grafana.com/security/security-advisories/cve-2026-19475

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories