CVE-2026-33380

🔶 medium

Summary

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

CVSS Score

6.3

Medium

EPSS Score

0.3

Exploit Probability

Published Date

2026-05-13

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 37.8% of all 365,312 vulnerabilities in our database.

#227,394

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 14, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-06-16

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-552

📦 Affected Products 5

Vendor	Product	Status	Affected Versions
grafana	grafana	Affected	> 11.6.0 < 11.6.14
grafana	grafana	Affected	> 12.2.0 < 12.2.8
grafana	grafana	Affected	> 12.3.0 < 12.3.6
grafana	grafana	Affected	> 12.4.0 < 12.4.3
grafana	grafana	Affected	> 13.0.0 < 13.0.1

🔗 References 1

https://grafana.com/security/security-advisories/cve...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-14199	⚠️ high	7.1	0.3	Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z...	2026-09-02
CVE-2026-33382	⚠️ high	7.5	0.4	Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing...	2026-07-10
CVE-2026-8595	🔶 medium	6.8	0.2	A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that ex...	2026-07-10
CVE-2026-8609	🔶 medium	5.3	0.4	An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory...	2026-07-10
CVE-2026-28378	ℹ️ low	3.1	0.1	The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio...	2026-07-07
CVE-2026-10601	🔶 medium	5.4	0.3	A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach uni...	2026-06-22

These CVEs affect the same products