CVE-2026-33380: grafana
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-33380CGA-32xm-x47g-5m8hCGA-654h-w3w3-f63rCGA-6frh-v6rm-6w65CGA-f56r-j4q6-3gchCGA-p2v8-gqcg-rg6xCGA-whc6-44j5-5p7qCGA-x5pw-f49r-7g4cCGA-xcc8-j32v-g2xhGHSA-gxcp-jjxh-rwp4BIT-grafana-2026-33380GO-2026-5409CGA-2262-g9m4-qh7gCGA-2267-vc35-9gg9CGA-24rm-74wp-4gf9CGA-262p-x7wv-m54jCGA-2qvg-5wxp-h29wCGA-39r7-7xmf-9gw4CGA-3hj4-mx5w-6p9mCGA-57q6-hcmm-57j8CGA-6fm6-jr4x-8qwvCGA-6jhc-fxq7-6975CGA-8648-v69m-jjhjCGA-8772-vxrm-8gphCGA-8f2m-x595-r853CGA-9666-64mm-8926CGA-9grr-mhcm-j48hCGA-9hxg-7c7q-m98mCGA-c626-x9fg-wjwgCGA-c7jj-3vg6-p982CGA-c7mc-xpv4-3qc9CGA-cmw7-66rq-q4hmCGA-cr3w-w97x-4vvmCGA-cwhv-jm87-4x8mCGA-fw49-hqwh-mqv9CGA-gp89-x34v-fc53CGA-gq4g-ph64-q428CGA-gr38-mwf2-xj7jCGA-h2g6-4v4m-cgrrCGA-jgqr-2fq8-ph3hCGA-jj3x-h35f-367gCGA-mm3q-2fcj-m578CGA-prqg-r73x-q3fqCGA-pvcf-h46x-f5rfCGA-pxqq-vjx9-j8pxCGA-q3hh-6rv5-7489CGA-r4r3-f4m5-w5g4CGA-rf52-g4wp-q82hCGA-rh99-hrrr-p49mCGA-rpj6-4vww-8gccCGA-rqf7-263v-m99wCGA-rxc3-mqc6-hvh7CGA-rxrv-p226-3r5cCGA-v23p-2jxx-fw6cCGA-v642-4xqx-4wfhCGA-v8fx-9582-v962CGA-vfph-3rhr-m565CGA-vq6f-6wmf-9v68CGA-w92c-p7ch-gf3cCGA-w9gv-m662-v636CGA-wf8x-87pg-gvx4CGA-wm6g-fcgc-hh2rCGA-wq47-pf8v-mrx3CGA-wv2m-8xc7-gpw3CGA-x249-cjwc-4x2hCGA-x623-crgp-f984CGA-xmj6-q52f-q8hmCGA-xw68-pf25-vg9r
Published 13-05-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-33380 is a medium (CVSS 6.5) vulnerability in grafana. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.5% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSources6 sources · 6.3–6.5
- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 20-09-2026
20-09-202620-10-2026
EPSS score0.35%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard11 products
- grafana-12.0All versions (No fix recorded)
- grafana-12.1All versions (No fix recorded)
- grafana-12.4< 12.4.3.02-r0
- grafana-fips-11.6< 11.6.16-r1
- grafana-fips-12.0All versions (No fix recorded)
Grafana2 products
- grafana≥ 11.6.0, < 11.6.14 | ≥ 12.2.0, < 12.2.8 | ≥ 12.3.0, < 12.3.6 | ≥ 12.4.0, < 12.4.3 | ≥ 13.0.0, < 13.0.1
- grafana oss≥ 11.6.0, ≤ 11.6.14 | ≥ 11.6.14, < 11.6.14+security-04 | ≥ 12.0.0, ≤ 12.2.8 | ≥ 12.2.8, < 12.2.8+security-04 | ≥ 12.3.0, ≤ 12.3.6 | ≥ 12.3.6, < 12.3.6+security-04 | ≥ 12.4.0, ≤ 12.4.3 | ≥ 12.4.3, < 12.4.3+security-02 | ≥ 13.0.0, ≤ 13.0.1 | ≥ 13.0.1, < 13.0.1+security-01
Github.com/grafana1 product
- grafana< 1.9.2-0.20260513165311-fb7336fc36c1 | All versions (No fix recorded)
Ubuntu1 product
- grafanaAll versions (No fix recorded)
Wolfi1 product
- grafana-12.4< 12.4.3.02-r0
5 vendors · 16 products
References
8 links
- github.com/grafana/grafanaPACKAGE