CyberRota Analysis
AI-GeneratedAuthenticated users with permission to query SQL data sources in Grafana can exploit a vulnerability by injecting the timeGroup macro through a WHERE clause, bypassing previous security measures. This leads to uncontrolled memory consumption, potentially causing the Grafana server process to terminate and resulting in a denial of service. Organizations using Grafana with Microsoft SQL Server, PostgreSQL, or MySQL data sources should prioritize addressing this vulnerability to maintain service availability.
Original NVD Description
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.