An authenticated user who has permission to query a SQL data source can inject the $__timeGroup macro into a WHERE clause. Grafana’s regex‑based macro parser does not filter this input, so evaluating the macro leads to uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The vulnerability is a classic example of resource exhaustion (CWE-400).

Grafana OSS and the Microsoft SQL Server, PostgreSQL, and MySQL data source plugins are affected. Users running these versions of Grafana with any active data source connection that allows query execution are at risk unless the vulnerability is patched.

The CVSS score of 6.5 indicates medium severity. An attacker must be authenticated and have query rights, so external attack vectors are limited to internal users or compromised accounts. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, so the known exploitation probability is unclear. However, because the exploit only requires a single malicious query, the risk to infrastructure that relies on Grafana dashboards is significant if the application is exposed to untrusted query inputs.