Grafana OSS EUVD-2026-30144

Exploitation requires an authenticated Grafana user account with at minimum low-privilege access (CVSS PR:L confirmed). A SQL datasource - such as PostgreSQL, MySQL, or Microsoft SQL Server - must be configured and accessible within the Grafana instance; deployments using only non-SQL datasources (Prometheus, Loki, InfluxDB, etc.) are not affected. The $__timeGroup macro must be usable in queries targeting that SQL datasource. The attack is not automatable (SSVC: Automatable=no), meaning exploitation requires sustained, manual interaction over approximately 30 minutes rather than a single-shot trigger. Deployments with auto-restart enabled (e.g., systemd with Restart=always) reduce the effective impact to near-zero. Exploitation is further limited by the absence of any scope change (S:U) - the crash is confined to the Grafana process itself.

The CVSS 6.5 score reflects a network-reachable, low-complexity denial-of-service with a significant availability impact (A:H) but zero confidentiality or integrity impact. The low-privilege requirement (PR:L) is a meaningful constraint - this is not an unauthenticated attack. Real-world risk is further dampened by multiple converging signals: EPSS stands at just 0.04% (12th percentile), indicating very low probability of exploitation in the near term; CISA SSVC classifies exploitation status as 'none' with only partial technical impact; and the attack itself requires approximately 30 minutes to achieve a crash, making it resource-intensive for an attacker and easily detectable via monitoring. The vendor explicitly notes that auto-restart configurations reduce impact to minimal or non-existent. No public exploit code exists and this is not listed in CISA KEV. This vulnerability is a genuine but operationally low-urgency issue - patching should occur in the normal patch cycle, with prioritization elevated only for internet-exposed Grafana instances with SQL datasources and no auto-restart configured.

An authenticated Grafana user with at least Viewer-level access to a dashboard backed by a SQL datasource crafts or modifies a panel query using the $__timeGroup macro in a manner that drives excessive memory allocation on the Grafana server process. Over approximately 30 minutes of sustained crafted queries, server memory is exhausted and the Grafana process crashes, causing a denial of service to all users. No public exploit code has been identified, and the slow-burn nature of the attack makes it more suited to a disgruntled insider or persistent low-sophistication attacker than opportunistic exploitation.