CVE-2026-33380

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-33380	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::

History

No history.

Information

Published : 2026-05-13 20:16

Updated : 2026-06-17 13:20

NVD link : CVE-2026-33380

Mitre link : CVE-2026-33380

CVE.ORG link : CVE-2026-33380

JSON object : View

Products Affected

grafana

grafana

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2026-33380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33380", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T15:12:34.365612Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "11.6.14", "lessThan": "11.6.14+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.2.8", "lessThan": "12.2.8+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.3.6", "lessThan": "12.3.6+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "12.4.3", "lessThan": "12.4.3+security-02", "versionType": "custom"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}, {"status": "affected", "version": "13.0.1", "lessThan": "13.0.1+security-01", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-13T20:16:20.697", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-33380", "tags": ["Vendor Advisory"], "source": "security@grafana.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable."}], "lastModified": "2026-06-17T13:20:16.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04916693-D14C-4B90-A469-51C2A2A66782", "versionEndExcluding": "11.6.14", "versionStartIncluding": "11.6.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0", "versionEndExcluding": "12.2.8", "versionStartIncluding": "12.2.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5", "versionEndExcluding": "12.3.6", "versionStartIncluding": "12.3.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A", "versionEndExcluding": "12.4.3", "versionStartIncluding": "12.4.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE07D597-63A4-4EF4-B2E2-DCA40D943D61", "versionEndExcluding": "13.0.1", "versionStartIncluding": "13.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}