CVEFinder.io

CVE-2026-33382

⚠ī¸ high
Summary

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

CVSS Score
7.5
High
EPSS Score
0.4
Exploit Probability
Published Date
2026-07-10
First Seen: 2026-07-11
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,890 vulnerabilities in our database.

#117,965
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 10, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
YES
Can be exploited automatically
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-07-13
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-400

đŸ“Ļ Affected Products 5

Vendor Product Status Affected Versions
grafana grafana Affected
> 11.6.0 < 11.6.15
grafana grafana Affected
> 12.2.0 < 12.2.9
grafana grafana Affected
> 12.3.0 < 12.3.7
grafana grafana Affected
> 12.4.0 < 12.4.4
grafana grafana Affected
> 13.0.0 < 13.0.2

🔗 References 1

https://grafana.com/security/security-advisories/cve...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-14199 ⚠ī¸ high 7.1 0.3 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z... 2026-09-02
CVE-2026-8595 đŸ”ļ medium 6.8 0.2 A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that ex... 2026-07-10
CVE-2026-8609 đŸ”ļ medium 5.3 0.4 An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory... 2026-07-10
CVE-2026-28378 ℹī¸ low 3.1 0.1 The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio... 2026-07-07
CVE-2026-10601 đŸ”ļ medium 5.4 0.3 A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach uni... 2026-06-22
CVE-2026-9029 ⚠ī¸ high 7.3 0.3 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer ... 2026-06-22
These CVEs affect the same products