CVE-2026-33376

Published: May 13, 2026Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: security@grafana.com (Secondary)

Description

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

Affected (13)

Products: Grafana: Grafana

Grafana

1 product

Grafana

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Grafana Grafana	From 12.2.0 to 12.2.8
Grafana Grafana	From 12.3.0 to 12.3.6
Grafana Grafana	From 12.4.0 to 12.4.3
Grafana Grafana	From 8.5.0 to 11.6.14
Grafana Grafana	Version 11.6.14
Grafana Grafana	Version 11.6.14 security01
Grafana Grafana	Version 12.2.8
Grafana Grafana	Version 12.2.8 security01
Grafana Grafana	Version 12.3.6
Grafana Grafana	Version 12.3.6 security01
Grafana Grafana	Version 12.4.3
Grafana Grafana	Version 13.0.0
Grafana Grafana	Version 13.0.1

Related CWEs

CWE-1188

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (1)

https://grafana.com/security/security-advisories/cve-2026-33376

Source: security@grafana.com

Vendor Advisory

Timeline

No history available yet.