EUVD-2026-30144
GHSA-rr8q-qwrv-9pf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
AnalysisAI
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (OOM) crash by exploiting the $__timeGroup macro against a configured SQL datasource. The attack is slow by nature - requiring upwards of 30 minutes to exhaust server memory - and affects Grafana OSS versions spanning from 8.0.0 through 13.0.1. Grafana reported this vulnerability directly, a vendor patch is available across all affected release branches, and no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption), where Grafana's $__timeGroup macro - a template variable used in panel queries to group time-series data - fails to bound memory allocation when used with a SQL datasource (e.g., PostgreSQL, MySQL, or Microsoft SQL Server). The macro likely generates increasingly large intermediate datasets or repetitive query structures that accumulate in server memory without adequate throttling or circuit-breaking. The affected product, identified by CPE cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*, is the open-source edition of Grafana, spanning a wide version range from 8.0.0 to the 13.x branch. The attack is not automatable (SSVC: Automatable=no), reflecting the manual, iterative nature of triggering progressive memory growth rather than a single-packet exploit.
RemediationAI
The primary fix is to upgrade Grafana OSS to one of the following vendor-released patched versions corresponding to your release branch: 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, or 13.0.1+security-01. Refer to the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-33378 for upgrade guidance. As a compensating control where immediate patching is not possible, restricting the Viewer or Editor role permissions to prevent use of SQL datasources with the $__timeGroup macro would eliminate the exploitation pathway, though this may impact legitimate dashboard functionality. Alternatively, configuring the Grafana server process to auto-restart (e.g., via systemd Restart=on-failure) significantly reduces impact to near-zero, as the vendor notes the crash requires 30+ minutes and an auto-restarting service limits sustained downtime. Rate-limiting or query timeout settings at the SQL datasource level (e.g., max execution time for MySQL, statement_timeout for PostgreSQL) may also throttle the memory accumulation, but this is not confirmed by vendor documentation and would need testing.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today