PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33375 Grafana CVE debrief

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. This vulnerability has a CVSS score of 6.5 and is classified as Medium severity. The flaw affects multiple versions of Grafana, including 11.6.0 to 11.6.14, 12.1.0 to 12.1.10, 12.2.0 to 12.2.8, 12.3.0 to 12.3.6, and 12.4.0 to 12.4.2. Users with low privileges can exploit this vulnerability without requiring high privileges or user interaction.

Vendor
Grafana
Product
Grafana OSS
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-26
Original CVE updated
2026-06-17
Advisory published
2026-03-26
Advisory updated
2026-06-17

Who should care

Grafana administrators and users with low privileges should be aware of this vulnerability. A low-privileged user can trigger an Out-Of-Memory crash, which can impact the availability of the Grafana service.

Technical summary

The CVE-2026-33375 vulnerability is caused by a logic flaw in the Grafana MSSQL data source plugin. This flaw allows a low-privileged user (Viewer) to bypass API restrictions. The vulnerability affects multiple versions of Grafana and can be exploited without requiring high privileges or user interaction. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a Medium severity vulnerability.

Defensive priority

Medium

Recommended defensive actions

  • Update Grafana to a version that patches this vulnerability
  • Restrict access to the Grafana MSSQL data source plugin
  • Monitor Grafana logs for suspicious activity
  • Implement additional security measures to prevent low-privileged users from exploiting this vulnerability
  • Consider upgrading to a version of Grafana that is not affected by this vulnerability
  • Review and update user privileges to prevent low-privileged users from accessing sensitive data

Evidence notes

The information provided is based on the CVE-2026-33375 record and the NVD detail page. The CVE record and NVD detail page provide information on the vulnerability, its severity, and the affected versions of Grafana.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33375 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33375

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33375 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33375

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.