{"id":"CVE-2026-107509","kind":"vulnerability","aliases":["CVE-2026-107509"],"related":[],"title":"Grafana: a Viewer-role user can crash the server with one SQL query","description":"A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).","summary":"A user with only the Viewer role can send one SQL Expression query that casts a value to a very large BINARY length, making Grafana allocate unbounded memory. The server crashes as a result.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grafana","infrastructure","self-hosted","viewer-role"],"not_affected_if":["no-viewer-users","sql-expressions-disabled"],"how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI.\n- Look for SQL Expressions being enabled in the Grafana configuration (unknown if the sources name the exact setting).","fix":null,"status":"open","published_at":"2026-11-11T15:17:13+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:48+00:00","updated_at":"2026-11-11T15:29:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T15:29:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: a Viewer-role user can crash the server with one SQL query","impact":"low","summary":"A user with only the Viewer role can send one SQL Expression query that casts a value to a very large BINARY length, making Grafana allocate unbounded memory. The server crashes as a result.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["grafana","self-hosted","viewer-role"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Grafana server crashes from memory exhaustion, causing denial of service","analyst_note":"Confirm the fixed Grafana versions and whether SQL Expressions is enabled by default, from the NVD page or Grafana's security advisory.","how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI.\n- Look for SQL Expressions being enabled in the Grafana configuration (unknown if the sources name the exact setting).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["sql-expressions-disabled","no-viewer-users"],"who_is_affected":"Teams running a self-hosted or managed Grafana instance where users hold the Viewer role and SQL Expressions are available. Instances where only trusted administrators can log in are less exposed. The sources do not name the fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4528,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107509':17A,20A '-2026':16A,19A 'alloc':54B,72C,98C 'amount':75C 'binari':50B,95C 'cast':43B,88C 'crash':8A,59B,79C 'cve':15A,18A 'excess':100C 'express':40B,85C 'grafana':1A,21B,53B,71C 'host':25B 'infrastructur':22B 'larg':49B,94C 'length':51B,96C 'make':52B,70C 'memori':56B,77C,97C 'one':12A,38B 'queri':14A,41B,86C 'result':62B 'role':5A,28B,35B,68C 'self':24B 'self-host':23B 'send':37B 'server':10A,58B 'singl':83C 'size':101C 'sql':13A,39B,84C 'unbound':55B,74C 'user':6A,30B,64C 'valu':45B,90C,102C 'viewer':4A,27B,34B,67C 'viewer-rol':3A,26B","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted or managed Grafana instance where users hold the Viewer role and SQL Expressions are available. Instances where only trusted administrators can log in are less exposed. The sources do not name the fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["grafana","infrastructure","medium","selfhosted","viewerrole"],"campaign_type":null,"search_a":"'-107509':17A,20A '-2026':16A,19A 'crash':8A 'cve':15A,18A 'grafana':1A 'one':12A 'queri':14A 'role':5A 'server':10A 'sql':13A 'user':6A 'viewer':4A 'viewer-rol':3A","search_b":"'alloc':54B 'binari':50B 'cast':43B 'crash':59B 'express':40B 'grafana':21B,53B 'host':25B 'infrastructur':22B 'larg':49B 'length':51B 'make':52B 'memori':56B 'one':38B 'queri':41B 'result':62B 'role':28B,35B 'self':24B 'self-host':23B 'send':37B 'server':58B 'sql':39B 'unbound':55B 'user':30B 'valu':45B 'viewer':27B,34B 'viewer-rol':26B","search_c":"'alloc':72C,98C 'amount':75C 'binari':95C 'cast':88C 'crash':79C 'excess':100C 'express':85C 'grafana':71C 'larg':94C 'length':96C 'make':70C 'memori':77C,97C 'queri':86C 'role':68C 'singl':83C 'size':101C 'sql':84C 'unbound':74C 'user':64C 'valu':90C,102C 'viewer':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107509","severity":null,"published_at":"2026-11-11T15:17:13+00:00","modified_at":"2026-11-11T15:17:13+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}