Description

An authenticated user with permission to query a SQL datasource (Microsoft SQL Server, PostgreSQL, or MySQL) could bypass the fix for CVE-2026-33375 by injecting the $__timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro triggers unbounded memory consumption, crashing the Grafana server process and causing a denial of service. The request can be repeated once the instance restarts.

Mitigation

Aliases