Answer in brief
CVE-2026-19475 records a Medium severity (CVSS 6.5) vulnerability in SQL Data Source Plugin: OOM DoS via $__timeGroup macro. The current sources do not mark it as known exploited. The current feed maps Grafana/Grafana OSS (generic), Grafana/Grafana OSS (generic), Grafana/Microsoft SQL Server Datasource (generic), Grafana/Microsoft SQL Server Datasource (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Grafana/Grafana OSS (generic), Grafana/Grafana OSS (generic), Grafana/Microsoft SQL Server Datasource (generic), Grafana/Microsoft SQL Server Datasource (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Grafana/Grafana OSSgeneric | 11.6.0 || 12.0.0 || 12.1.0 || 12.2.0 || 12.3.0 || 12.4.0 || 13.0.0 || 13.1.0 | Not reported |
| Grafana/Grafana OSSgeneric | >=11.6.0 <=11.6.16 || >=12.0.0 <=12.0.10 || >=12.1.0 <=12.1.10 || >=12.2.0 <=12.2.10 || >=12.3.0 <=12.3.11 || >=12.4.0 <=12.4.9 || >=13.0.0 <=13.0.7 || >=13.1.0 <=13.1.4 | Not reported |
| Grafana/Microsoft SQL Server Datasourcegeneric | 13.0.0 | Not reported |
| Grafana/Microsoft SQL Server Datasourcegeneric | >=13.0.0 <=13.0.1 | Not reported |
| Grafana/MySQL Datasourcegeneric | 13.0.0 | Not reported |
| Grafana/MySQL Datasourcegeneric | >=13.0.0 <=13.0.2 | Not reported |
| Grafana/PostgreSQL Datasourcegeneric | 13.0.0 | Not reported |
| Grafana/PostgreSQL Datasourcegeneric | >=13.0.0 <=13.0.1 | Not reported |
Published upstream
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 2, 2026
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Quoted source text, attributed separately from HOL analysis.