Description

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T16:17:15.120Z",
  "pubdate": "2026-09-02T16:17:15.120Z",
  "executiveSummary": "This vulnerability involves a macro injection flaw within Grafana's SQL data source connectivity, identified as a bypass of the fix for CVE-2026-33375.\nThe issue manifests as an improper validation of user-supplied input when processing SQL macros, specifically the timeGroup macro, within WHERE clauses.\nBy successfully injecting this macro, an authenticated attacker with existing permissions to query a SQL data source can trigger uncontrolled memory consumption on the Grafana server.\nThis resource exhaustion leads to an unhandled exception or process termination, resulting in a Denial of Service (DoS) for the affected Grafana instance.\nThe vulnerability affects Microsoft SQL Server, PostgreSQL, and MySQL data source integrations. Successful exploitation requires an authenticated user with permission to execute queries against configured data sources.\nThe risk is primarily operational, as the crash interrupts service availability for all users of the platform, requiring a restart of the Grafana process to restore functionality.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization and overly permissive regex-based parsing mechanism used by Grafana to process SQL macros.\nDespite previous remediation efforts under CVE-2026-33375, the macro parser fails to adequately validate the structural integrity of user input when it is placed within a WHERE clause context.\nWhen a query containing an injected timeGroup macro is submitted, the Grafana backend engine attempts to resolve and evaluate this macro dynamically.\nThe exploitation flow begins when an authenticated user crafts a SQL query where the WHERE clause includes the malicious timeGroup macro syntax. Because the regex-based validation is bypassable, the input is passed to the underlying query execution engine rather than being stripped or rejected.\nUpon evaluation, the application triggers a logic path that attempts to allocate excessive system memory to process the parameters associated with the injected timeGroup function.\nThis uncontrolled memory allocation leads to a state of resource exhaustion, where the server process exceeds available heap limits or triggers an out-of-memory (OOM) kill signal from the operating system.\nThe vulnerability is present in the data source query execution modules responsible for Microsoft SQL Server, PostgreSQL, and MySQL. Because these modules share similar macro-processing logic, they are all susceptible to the same injection vector.\nPost-exploitation impact is strictly centered on availability. Since the crash occurs at the process level, the entire Grafana service becomes unresponsive, preventing all other authenticated users from performing dashboard operations, data visualization, or administrative tasks until the service is manually or automatically restarted.\nThe attack is considered highly reliable for an attacker possessing standard authenticated privileges, as it does not rely on complex memory corruption techniques but rather exploits intended, yet improperly secured, server-side evaluation logic."
}