CVE-2026-33380
Full vulnerability record from the local CVENow database.
Description
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 20:16:20.697000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-33380",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T20:16:20.697",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable."
},
{
"lang": "es",
"value": "Una vulnerabilidad en Expresiones SQL permite a un atacante autenticado leer archivos arbitrarios del sistema de archivos del servidor de Grafana. Solo las instancias con la función de alternancia sqlExpressions habilitada son vulnerables."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Grafana",
"product": "Grafana OSS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "11.6.0",
"lessThanOrEqual": "11.6.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.6.14",
"lessThan": "11.6.14+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0.0",
"lessThanOrEqual": "12.2.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.2.8",
"lessThan": "12.2.8+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.3.0",
"lessThanOrEqual": "12.3.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.3.6",
"lessThan": "12.3.6+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.4.0",
"lessThanOrEqual": "12.4.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.4.3",
"lessThan": "12.4.3+security-02",
"versionType": "custom",
"status": "affected"
},
{
"version": "13.0.0",
"lessThanOrEqual": "13.0.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0.1",
"lessThan": "13.0.1+security-01",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 4.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-14T15:12:34.365612Z",
"id": "CVE-2026-33380",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-552"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.6.0",
"versionEndExcluding": "11.6.14",
"matchCriteriaId": "04916693-D14C-4B90-A469-51C2A2A66782"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.2.0",
"versionEndExcluding": "12.2.8",
"matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.3.0",
"versionEndExcluding": "12.3.6",
"matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.4.0",
"versionEndExcluding": "12.4.3",
"matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "13.0.0",
"versionEndExcluding": "13.0.1",
"matchCriteriaId": "EE07D597-63A4-4EF4-B2E2-DCA40D943D61"
}
]
}
]
}
],
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2026-33380",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}