The Grafana MSSQL data source plugin has a logic flaw that lets a Viewer‑level user bypass API restrictions and cause the system to consume all available memory, leading to an out‑of‑memory crash of the host container. The vulnerability therefore results in a denial‑of‑service condition, disrupting site availability without affecting the confidentiality of data. The underlying weakness is a lack of proper privilege enforcement in the API layer.

All Grafana OSS deployments that use the MSSQL data source plugin are affected. Vendor and product information is listed as Grafana OSS; specific product versions are not disclosed in the advisory, so any instance with the plugin should be considered at risk until a patch is applied.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is exploitation of the Grafana API by a low‑privileged Viewer user; the user only needs access permissions to the Grafana instance and to invoke the API that triggers memory allocation. Once triggered, the container will crash, causing downtime for the service.