EUVD-2026-30144
GHSA-rr8q-qwrv-9pf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
AnalysisAI
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (OOM) crash by exploiting the $__timeGroup macro against a configured SQL datasource. The attack is slow by nature - requiring upwards of 30 minutes to exhaust server memory - and affects Grafana OSS versions spanning from 8.0.0 through 13.0.1. Grafana reported this vulnerability directly, a vendor patch is available across all affected release branches, and no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption), where Grafana's $__timeGroup macro - a template variable used in panel queries to group time-series data - fails to bound memory allocation when used with a SQL datasource (e.g., PostgreSQL, MySQL, or Microsoft SQL Server). The macro likely generates increasingly large intermediate datasets or repetitive query structures that accumulate in server memory without adequate throttling or circuit-breaking. The affected product, identified by CPE cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*, is the open-source edition of Grafana, spanning a wide version range from 8.0.0 to the 13.x branch. The attack is not automatable (SSVC: Automatable=no), reflecting the manual, iterative nature of triggering progressive memory growth rather than a single-packet exploit.
RemediationAI
The primary fix is to upgrade Grafana OSS to one of the following vendor-released patched versions corresponding to your release branch: 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, or 13.0.1+security-01. Refer to the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-33378 for upgrade guidance. As a compensating control where immediate patching is not possible, restricting the Viewer or Editor role permissions to prevent use of SQL datasources with the $__timeGroup macro would eliminate the exploitation pathway, though this may impact legitimate dashboard functionality. Alternatively, configuring the Grafana server process to auto-restart (e.g., via systemd Restart=on-failure) significantly reduces impact to near-zero, as the vendor notes the crash requires 30+ minutes and an auto-restarting service limits sustained downtime. Rate-limiting or query timeout settings at the SQL datasource level (e.g., max execution time for MySQL, statement_timeout for PostgreSQL) may also throttle the memory accumulation, but this is not confirmed by vendor documentation and would need testing.
More in Grafana Oss
View allPrivilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just
Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions becau
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to o
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory b
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sendin
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to t
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlE
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete ar
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test e
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, re
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today