CVE-2026-33378

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

May 13, 2026, 7:28:37 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.33% · Oct 25, 2026

A flaw was found in Grafana. A remote attacker with authenticated access to a SQL datasource can exploit a vulnerability in the `$__timeGroup` macro. By sending specially crafted queries, an attacker can cause an Out of Memory (OOM) error, leading to the Grafana server crashing and resulting in a Denial of Service (DoS). This can disrupt the availability of the Grafana instance. grafana: Grafana: Denial of Service due to Out of Memory via $__timeGroup macro A moderate severity denial of service flaw was found in Grafana. A remote attacker with authenticated access to a Grafana instance that has a SQL data source configured can send specially crafted queries that abuse the $__timeGroup macro to exhaust memory on the server, causing an out-of-memory (OOM) crash that disrupts the availability of the Grafana instance. Exploitation requires valid credentials and a configured SQL data source, and the attack can take upwards of half an hour to crash the server, so the practical impact is reduced on deployments configured to automatically restart the service. This issue affects the grafana12.4, grafana13.1, and grafana13.2 components shipped in Red Hat Hardened Images (hummingbird-1), where a fix is being pursued; the hi/grafana container image distributed for hummingbird-1 is not affected because the vulnerable component is not present. Red Hat rates this flaw Moderate (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), consistent with the upstream Medium severity rating. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.