Vulnerability-Lookup

OPENSUSE-SU-2026:10932-1

Vulnerability from csaf_opensuse - Published: 2026-06-02 00:00 - Updated: 2026-06-02 00:00

Summary

grafana-11.6.14+security04-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: grafana-11.6.14+security04-1.1 on GA media

Description of the patch: These are all security issues fixed in the grafana-11.6.14+security04-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10932

CVE-2026-28374

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-28376

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-28379

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-28380

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-28383

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-33376

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-33377

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-33378

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-33380

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-33381

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-28374/	self
https://www.suse.com/security/cve/CVE-2026-28376/	self
https://www.suse.com/security/cve/CVE-2026-28379/	self
https://www.suse.com/security/cve/CVE-2026-28380/	self
https://www.suse.com/security/cve/CVE-2026-28383/	self
https://www.suse.com/security/cve/CVE-2026-33376/	self
https://www.suse.com/security/cve/CVE-2026-33377/	self
https://www.suse.com/security/cve/CVE-2026-33378/	self
https://www.suse.com/security/cve/CVE-2026-33380/	self
https://www.suse.com/security/cve/CVE-2026-33381/	self
https://www.suse.com/security/cve/CVE-2026-28374	external
https://bugzilla.suse.com/1265290	external
https://www.suse.com/security/cve/CVE-2026-28376	external
https://bugzilla.suse.com/1265289	external
https://www.suse.com/security/cve/CVE-2026-28379	external
https://bugzilla.suse.com/1265288	external
https://www.suse.com/security/cve/CVE-2026-28380	external
https://bugzilla.suse.com/1265287	external
https://www.suse.com/security/cve/CVE-2026-28383	external
https://bugzilla.suse.com/1265286	external
https://www.suse.com/security/cve/CVE-2026-33376	external
https://bugzilla.suse.com/1265285	external
https://www.suse.com/security/cve/CVE-2026-33377	external
https://bugzilla.suse.com/1265284	external
https://www.suse.com/security/cve/CVE-2026-33378	external
https://bugzilla.suse.com/1265283	external
https://www.suse.com/security/cve/CVE-2026-33380	external
https://bugzilla.suse.com/1265282	external
https://www.suse.com/security/cve/CVE-2026-33381	external
https://bugzilla.suse.com/1265281	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "grafana-11.6.14+security04-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the grafana-11.6.14+security04-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10932",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10932-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28374 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28374/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28376 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28376/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28379 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28379/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28380 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28383 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28383/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33376 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33376/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33377 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33378 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33378/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33380 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33381 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33381/"
      }
    ],
    "title": "grafana-11.6.14+security04-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-06-02T00:00:00Z",
      "generator": {
        "date": "2026-06-02T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10932-1",
      "initial_release_date": "2026-06-02T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-02T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security04-1.1.aarch64",
                "product": {
                  "name": "grafana-11.6.14+security04-1.1.aarch64",
                  "product_id": "grafana-11.6.14+security04-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security04-1.1.ppc64le",
                "product": {
                  "name": "grafana-11.6.14+security04-1.1.ppc64le",
                  "product_id": "grafana-11.6.14+security04-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security04-1.1.s390x",
                "product": {
                  "name": "grafana-11.6.14+security04-1.1.s390x",
                  "product_id": "grafana-11.6.14+security04-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security04-1.1.x86_64",
                "product": {
                  "name": "grafana-11.6.14+security04-1.1.x86_64",
                  "product_id": "grafana-11.6.14+security04-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security04-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64"
        },
        "product_reference": "grafana-11.6.14+security04-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security04-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le"
        },
        "product_reference": "grafana-11.6.14+security04-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security04-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x"
        },
        "product_reference": "grafana-11.6.14+security04-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security04-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        },
        "product_reference": "grafana-11.6.14+security04-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-28374",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28374"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28374",
          "url": "https://www.suse.com/security/cve/CVE-2026-28374"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265290 for CVE-2026-28374",
          "url": "https://bugzilla.suse.com/1265290"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28374"
    },
    {
      "cve": "CVE-2026-28376",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28376"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28376",
          "url": "https://www.suse.com/security/cve/CVE-2026-28376"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265289 for CVE-2026-28376",
          "url": "https://bugzilla.suse.com/1265289"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28376"
    },
    {
      "cve": "CVE-2026-28379",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28379"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28379",
          "url": "https://www.suse.com/security/cve/CVE-2026-28379"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265288 for CVE-2026-28379",
          "url": "https://bugzilla.suse.com/1265288"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28379"
    },
    {
      "cve": "CVE-2026-28380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Any Editor could delete any snapshot, even if they have no access to read or write them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28380",
          "url": "https://www.suse.com/security/cve/CVE-2026-28380"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265287 for CVE-2026-28380",
          "url": "https://bugzilla.suse.com/1265287"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28380"
    },
    {
      "cve": "CVE-2026-28383",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28383"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28383",
          "url": "https://www.suse.com/security/cve/CVE-2026-28383"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265286 for CVE-2026-28383",
          "url": "https://bugzilla.suse.com/1265286"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28383"
    },
    {
      "cve": "CVE-2026-33376",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33376"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33376",
          "url": "https://www.suse.com/security/cve/CVE-2026-33376"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265285 for CVE-2026-33376",
          "url": "https://bugzilla.suse.com/1265285"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33376"
    },
    {
      "cve": "CVE-2026-33377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33377",
          "url": "https://www.suse.com/security/cve/CVE-2026-33377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265284 for CVE-2026-33377",
          "url": "https://bugzilla.suse.com/1265284"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33377"
    },
    {
      "cve": "CVE-2026-33378",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33378"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33378",
          "url": "https://www.suse.com/security/cve/CVE-2026-33378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265283 for CVE-2026-33378",
          "url": "https://bugzilla.suse.com/1265283"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33378"
    },
    {
      "cve": "CVE-2026-33380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server\u0027s filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33380",
          "url": "https://www.suse.com/security/cve/CVE-2026-33380"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265282 for CVE-2026-33380",
          "url": "https://bugzilla.suse.com/1265282"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33380"
    },
    {
      "cve": "CVE-2026-33381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When a user\u0027s access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33381",
          "url": "https://www.suse.com/security/cve/CVE-2026-33381"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265281 for CVE-2026-33381",
          "url": "https://bugzilla.suse.com/1265281"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security04-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33381"
    }
  ]
}

CVE-2026-28374 (GCVE-0-2026-28374)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 12:33

Title

IDOR in Annotations API allows unprivileged users to DELETE annotation

Summary

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.5.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T12:32:58.713813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T12:33:13.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:07.631Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28374"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "IDOR in Annotations API allows unprivileged users to DELETE annotation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28374",
    "datePublished": "2026-05-13T19:28:40.053Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-05-14T12:33:13.749Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28376 (GCVE-0-2026-28376)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 18:10

Title

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

Summary

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.0.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T18:10:50.762919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T18:10:54.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:07.723Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28376"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Grafana Live push endpoint allows unbounded memory allocation leading to OOM"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28376",
    "datePublished": "2026-05-13T19:28:26.544Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-05-14T18:10:54.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28379 (GCVE-0-2026-28379)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 18:12

Title

Viewer-triggered race condition in Grafana Live leads to complete server crash

Summary

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.2.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T18:12:23.118907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T18:12:49.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:07.631Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28379"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Viewer-triggered race condition in Grafana Live leads to complete server crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28379",
    "datePublished": "2026-05-13T19:28:25.836Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-05-14T18:12:49.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28380 (GCVE-0-2026-28380)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 15:55

Title

BAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Summary

Any Editor could delete any snapshot, even if they have no access to read or write them.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 9.4.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:54:58.435055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:55:03.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "9.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Any Editor could delete any snapshot, even if they have no access to read or write them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:07.725Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28380"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "BAC in Snapshot API allows deletion of unauthorized dashboard snapshots"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28380",
    "datePublished": "2026-05-13T19:28:32.257Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-05-14T15:55:03.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28383 (GCVE-0-2026-28383)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 12:36

Title

Grafana plugin resources can lead to unbounded memory allocation

Summary

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 6.7.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T12:35:48.301448Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T12:36:22.328Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:07.915Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28383"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Grafana plugin resources can lead to unbounded memory allocation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28383",
    "datePublished": "2026-05-13T19:28:36.952Z",
    "dateReserved": "2026-02-27T07:16:12.219Z",
    "dateUpdated": "2026-05-14T12:36:22.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33376 (GCVE-0-2026-33376)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-16 03:56

Title

Auth Proxy IPv6 whitelist bypass

Summary

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 9.4.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1188",
                "description": "CWE-1188 Initialization of a Resource with an Insecure Default",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-16T03:56:01.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "9.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:08.211Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33376"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Auth Proxy IPv6 whitelist bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33376",
    "datePublished": "2026-05-13T19:28:34.473Z",
    "dateReserved": "2026-03-19T07:55:06.977Z",
    "dateUpdated": "2026-05-16T03:56:01.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33377 (GCVE-0-2026-33377)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-18 18:33

Title

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

Summary

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.5.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-16T03:55:59.661383Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T18:33:09.317Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:08.443Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Dashboard Import Overwrites ACL \u2014 Editor Privilege Escalation to Dashboard Admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33377",
    "datePublished": "2026-05-13T19:28:28.154Z",
    "dateReserved": "2026-03-19T07:55:06.977Z",
    "dateUpdated": "2026-05-18T18:33:09.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33378 (GCVE-0-2026-33378)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 12:33

Title

Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Summary

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.0.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T12:33:44.094482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T12:33:58.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:08.707Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33378"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33378",
    "datePublished": "2026-05-13T19:28:37.606Z",
    "dateReserved": "2026-03-19T07:55:06.977Z",
    "dateUpdated": "2026-05-14T12:33:58.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33380 (GCVE-0-2026-33380)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-14 15:12

Title

SQL Expressions Read File From Disk

Summary

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-552 - Files or Directories Accessible to External Parties

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:12:34.365612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-552",
                "description": "CWE-552 Files or Directories Accessible to External Parties",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:12:46.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server\u0027s filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:08.876Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33380"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "SQL Expressions Read File From Disk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33380",
    "datePublished": "2026-05-13T19:28:32.915Z",
    "dateReserved": "2026-03-19T07:55:06.978Z",
    "dateUpdated": "2026-05-14T15:12:46.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33381 (GCVE-0-2026-33381)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-05-16 03:55

Title

Users can generate Service Account tokens after permissions removal

Summary

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 9.2.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-16T03:55:59.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem"
          ],
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "9.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When a user\u0027s access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:35:08.982Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33381"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Users can generate Service Account tokens after permissions removal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33381",
    "datePublished": "2026-05-13T19:28:31.559Z",
    "dateReserved": "2026-03-19T07:55:06.978Z",
    "dateUpdated": "2026-05-16T03:55:59.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10932-1

CVE-2026-28374 (GCVE-0-2026-28374)

CVE-2026-28376 (GCVE-0-2026-28376)

CVE-2026-28379 (GCVE-0-2026-28379)

CVE-2026-28380 (GCVE-0-2026-28380)

CVE-2026-28383 (GCVE-0-2026-28383)

CVE-2026-33376 (GCVE-0-2026-33376)

CVE-2026-33377 (GCVE-0-2026-33377)

CVE-2026-33378 (GCVE-0-2026-33378)

CVE-2026-33380 (GCVE-0-2026-33380)

CVE-2026-33381 (GCVE-0-2026-33381)

Tags

Sightings

Nomenclature