Grafana EUVD-2026-70104

Exploitation requires a valid Grafana account with at least low-privilege query access (PR:L) to a SQL data source of type Microsoft SQL Server, PostgreSQL, or MySQL - this is standard permission for Grafana editors and viewers with data source access in most multi-user deployments. The attacker must be able to submit a query containing a WHERE clause; no special Grafana configuration beyond having a SQL data source provisioned is needed. Exploitation is blocked for unauthenticated users and for authenticated users whose accounts have no SQL data source query permissions. Impact is strictly limited to availability - no credentials, query results, or configuration data are disclosed or modified.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat profile: network-reachable, low-complexity, but requiring a valid authenticated session with SQL data source query permissions (PR:L). Impact is purely availability - the Grafana server process crashes, causing a denial of service for all users until restarted; there is no confidentiality or integrity component. The bypass nature of this vulnerability is an escalating signal: the injection pattern was already characterized during CVE-2026-33375 research, meaning researchers familiar with that prior work may have identified this gap quickly. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation status is unconfirmed. In multi-tenant Grafana deployments where many users hold query permissions on shared SQL data sources, the pool of potential actors is larger than a typical PR:L scenario. The risk is real but bounded to availability and limited to environments exposing SQL data sources to non-admin users.

An authenticated Grafana editor with access to a shared PostgreSQL data source crafts a panel query embedding the timeGroup macro inside a WHERE clause predicate. Grafana's regex-based macro filter, which was introduced to remediate CVE-2026-33375, does not match this injection path and passes the query to the macro evaluator. The evaluator processes the macro and enters an unbounded memory allocation loop, causing the Grafana server process to be killed by the OS, taking all dashboards and alerts offline until a manual restart.