Grafana: Denial of service through memory exhaustion in SQL Expressions
Summary
Grafana OSS and Grafana Enterprise in the listed 13.x versions contain a flaw in the SQL Expressions feature. A user with the Viewer role can send a single SQL Expression query that casts a value to a very large BINARY length, which makes Grafana allocate an unbounded amount of memory and crash. The attacker needs a valid Viewer account, and the impact is limited to availability; no data is exposed.
Affected
- Grafana OSS 13.1.0 to 13.1.9
- Grafana OSS 13.2.0 to 13.2.5
- Grafana OSS 13.3.0 (default: unaffected, according to the CVE record)
- Grafana Enterprise 13.1.0 to 13.1.9
- Grafana Enterprise 13.2.0 to 13.2.5
- Grafana Enterprise 13.3.0 (default: unaffected, according to the CVE record)
Fixed in
- Grafana 13.3.1 (listed in the Grafana v13.3.1 release notes)
- Fixed versions for the 13.1.x and 13.2.x branches: Unknown. Confirm in the Grafana advisory.
- Distribution packages (for example Red Hat or SUSE): check the distributor advisory for their own version numbers.
Workaround
- No workaround published by the vendor. Unknown.
- Restrict Viewer role assignments to necessary users only.
- Check whether anonymous access is enabled, because it effectively grants Viewer rights to anyone who can reach the instance.
- Set container or systemd memory limits so that a crash is contained and the service restarts automatically (own recommendation, not from the vendor).
Exploitation
- Not known to be exploited (OffSeq classification).
- No public proof of concept, CISA KEV listing or vendor statement on exploitation found at the time of research.
Our recommendation
- Inventory all Grafana OSS and Enterprise instances, including container images and Helm deployments, and record their exact versions.
- Upgrade affected 13.x instances to 13.3.1 or to the fixed version listed by the vendor for your branch.
- Until patched, review Viewer and anonymous accounts and set memory limits.
- Prioritise internet-facing instances and instances with shared or external user accounts.
- Re-check the Grafana advisory for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana security advisory CVE-2026-107509 grafana.com
- Grafana v13.3.1 release notes github.com
- OffSeq threat radar: CVE-2026-107509 radar.offseq.com
- Grafana community Helm charts issue 990 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:25.
Original description (NVD)
A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.