CVE-2026-107509— Memory exhaustion denial of service in SQL Expressions
Quick assessment
Affected
Grafana Grafana OSS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
拥有“查看者（Viewer）”角色的用户可通过一条将值转换为超大长度 BINARY 类型的 SQL 表达式查询，强制 Grafana 分配无限制的内存，从而导致其崩溃（即因请求分配过大的内存值而引发问题）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107509
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Memory exhaustion denial of service in SQL Expressions
Source: CVE Program / CVE List V5
Vulnerability Description
A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana OSS | 13.1.0 ~ 13.1.9 | - |
|
| Grafana | Grafana Enterprise | 13.1.0 ~ 13.1.9 | - |
|
II. Public POCs for CVE-2026-107509
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107509
请登录查看更多情报信息。
Other References for CVE-2026-107509 (1)
-
https://grafana.com/security/security-advisories/cve-2026-107509 vendor-advisory
Same Patch Batch · Grafana · 2026-11-11 · 9 CVEs total
| CVE-2026-102589 | 7.1 HIGH | Cross-instance user impersonation through image renderer JWTs |
| CVE-2026-111000 | 7.1 HIGH | Privilege escalation through folder move in the folders API |
| CVE-2026-111024 | 7.1 HIGH | Folder permission bypass in the Git Sync repository files API |
| CVE-2026-13721 | 6.5 MEDIUM | Folder authorization bypass in the Git Sync provisioning files API |
| CVE-2026-14242 | 6.5 MEDIUM | Authorization bypass in the Git Sync provisioning jobs API |
| CVE-2026-110992 | 6.5 MEDIUM | Path traversal in Git Sync delete and move jobs |
| CVE-2026-110289 | 5.5 MEDIUM | Git Sync connections send credentials to unvalidated server URLs |
| CVE-2026-82014 | 4.3 MEDIUM | Team preferences RBAC bypass through the set-home-dash endpoint |
IV. Related Vulnerabilities
Same product: Grafana OSS
-
CVE-2026-102589
Cross-instance user impersonation through image renderer JWT -
CVE-2026-110992
Path traversal in Git Sync delete and move jobs -
CVE-2026-14242
Authorization bypass in the Git Sync provisioning jobs API -
CVE-2026-33379
Dashboard snapshot permission bypass -
CVE-2026-79656
OAuth and OIDC tokens written unredacted to server logs by t
Same vendor: Grafana
-
CVE-2026-110289
Git Sync connections send credentials to unvalidated server -
CVE-2026-102589
Cross-instance user impersonation through image renderer JWT -
CVE-2026-111024
Folder permission bypass in the Git Sync repository files AP -
CVE-2026-111000
Privilege escalation through folder move in the folders API -
CVE-2026-110992
Path traversal in Git Sync delete and move jobs
Same weakness: CWE-789
-
CVE-2026-115864
Monoceros versions before 0.30 for Perl allow a request decl -
CVE-2026-125263
FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhance -
CVE-2026-125226
FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen -
CVE-2026-125207
FFmpeg through 9.0.2 Excessive Memory Allocation via Interpl -
CVE-2026-125104
FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder a