PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33375 Grafana CVE debrief

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. This vulnerability has a CVSS score of 6.5 and is classified as Medium severity. The flaw affects multiple versions of Grafana, including 11.6.0 to 11.6.14, 12.1.0 to 12.1.10, 12.2.0 to 12.2.8, 12.3.0 to 12.3.6, and 12.4.0 to 12.4.2. Users with low privileges can exploit this vulnerability without requiring high privileges or user interaction.

Vendor
Grafana
Product
Grafana OSS
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-26
Original CVE updated
2026-06-17
Advisory published
2026-03-26
Advisory updated
2026-06-17

Who should care

Grafana administrators and users with low privileges should be aware of this vulnerability. A low-privileged user can trigger an Out-Of-Memory crash, which can impact the availability of the Grafana service.

Technical summary

The CVE-2026-33375 vulnerability is caused by a logic flaw in the Grafana MSSQL data source plugin. This flaw allows a low-privileged user (Viewer) to bypass API restrictions. The vulnerability affects multiple versions of Grafana and can be exploited without requiring high privileges or user interaction. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a Medium severity vulnerability.

Defensive priority

Medium

Recommended defensive actions

  • Update Grafana to a version that patches this vulnerability
  • Restrict access to the Grafana MSSQL data source plugin
  • Monitor Grafana logs for suspicious activity
  • Implement additional security measures to prevent low-privileged users from exploiting this vulnerability
  • Consider upgrading to a version of Grafana that is not affected by this vulnerability
  • Review and update user privileges to prevent low-privileged users from accessing sensitive data

Evidence notes

The information provided is based on the CVE-2026-33375 record and the NVD detail page. The CVE record and NVD detail page provide information on the vulnerability, its severity, and the affected versions of Grafana.

Official resources

CVE-2026-33375 was published on 2026-03-26T21:17:05.573Z and modified on 2026-06-17T13:20:16.357Z.