CVE-2026-33381: grafana Improper Access Control
CVSS: 8.1v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-33381CGA-59v9-3gxv-6rp6CGA-674p-9w6r-gjq2CGA-gr5c-62xx-qhcpCGA-hffp-93xc-7vrvCGA-hfv4-97g6-w3hhCGA-mvpq-mp69-8xj2CGA-v7pq-q62h-62qhCGA-wh3x-x6wq-ffhfGHSA-wfhv-mj62-f5xhBIT-grafana-2026-33381GO-2026-5708CGA-2wgr-vjr4-9vv4CGA-3m78-p9p7-r2jhCGA-4386-85c8-8v88CGA-4hhj-rc95-j8m3CGA-4x97-mh2w-c6qfCGA-5383-3f68-qfm6CGA-57p6-598q-q237CGA-5pgf-m3wx-7w48CGA-5qc2-45cg-q5vwCGA-6x82-q6px-hqpfCGA-7ffw-7mv3-9mrfCGA-7mfm-ppv2-cvqpCGA-7xcc-3jgq-9g2xCGA-7xrw-v9gg-4r92CGA-8578-753j-qwc2CGA-8f9p-gm54-rh4pCGA-8mvf-v688-c6jcCGA-92hh-cq6r-hh25CGA-94p4-4m7g-36wvCGA-98r5-jfch-348hCGA-9q23-x984-xwgrCGA-cvhh-3xm7-v9mfCGA-fmq7-hfr7-5c6mCGA-fq88-r9p6-r9h8CGA-fvgw-4h3h-54f5CGA-fx2q-gffg-qvgqCGA-g333-m2mh-5465CGA-gm6p-65mg-893mCGA-gqhv-chp5-8r6hCGA-gqmx-pr64-56cgCGA-h58w-46qj-4425CGA-hq23-48qx-8w86CGA-hwr8-mx49-ccpjCGA-hxwm-wvc3-77f6CGA-j7rc-4g9v-w9fgCGA-j93f-f697-hqhgCGA-jgq4-gvpf-wfxjCGA-jjww-m9rh-526vCGA-jvxc-96x6-r36fCGA-p9vj-34xq-2q44CGA-q6cm-8g63-2gg7CGA-qc86-crpc-f8r5CGA-qf2h-wwr4-9xvvCGA-qf65-c366-hqmvCGA-qg3q-f7j2-frxcCGA-r4jh-9w58-xxjvCGA-rx38-c465-w4j2CGA-v4p3-x7w9-2ph8CGA-v88p-p8wp-8q37CGA-vpm8-3qg5-v5j7CGA-vwqv-7jx6-wvf8CGA-wc7p-9fgv-63rvCGA-wqf6-53mj-463qCGA-wxg2-82cj-3wvfCGA-x2fh-x736-3mj3CGA-x8w3-96q9-fqpw
Published 13-05-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-33381 is a high (CVSS 8.1) Improper Access Control vulnerability in grafana. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.7% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSources6 sources · 5.9–8.1
- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 20-09-2026
20-09-202620-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard11 products
- grafana-12.0All versions (No fix recorded)
- grafana-12.1All versions (No fix recorded)
- grafana-12.4< 12.4.3.02-r0
- grafana-fips-11.6< 11.6.16-r1
- grafana-fips-12.0All versions (No fix recorded)
Grafana2 products
- grafana≥ 11.6.0, < 11.6.14 | ≥ 12.2.0, < 12.2.8 | ≥ 12.3.0, < 12.3.6 | ≥ 12.4.0, < 12.4.3 | ≥ 13.0.0, < 13.0.1
- grafana oss≥ 9.2.0, ≤ 11.6.14 | ≥ 11.6.14, < 11.6.14+security-04 | ≥ 12.0.0, ≤ 12.2.8 | ≥ 12.2.8, < 12.2.8+security-04 | ≥ 12.3.0, ≤ 12.3.6 | ≥ 12.3.6, < 12.3.6+security-04 | ≥ 12.4.0, ≤ 12.4.3 | ≥ 12.4.3, < 12.4.3+security-02 | ≥ 13.0.0, ≤ 13.0.1 | ≥ 13.0.1, < 13.0.1+security-01
Github.com/grafana1 product
- grafana< 1.9.2-0.20260513165311-fb7336fc36c1 | All versions (No fix recorded)
Ubuntu1 product
- grafanaAll versions (No fix recorded)
Wolfi1 product
- grafana-12.4< 12.4.3.02-r0
5 vendors · 16 products
References
8 links
- github.com/grafana/grafanaPACKAGE