CVE-2026-33380

Published: May 13, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Affected (5)

Products: Grafana: Grafana

Grafana

1 product

Grafana

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Grafana Grafana	From 11.6.0 to 11.6.14
Grafana Grafana	From 12.2.0 to 12.2.8
Grafana Grafana	From 12.3.0 to 12.3.6
Grafana Grafana	From 12.4.0 to 12.4.3
Grafana Grafana	From 13.0.0 to 13.0.1

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (1)

https://grafana.com/security/security-advisories/cve-2026-33380

Source: security@grafana.com

Vendor Advisory

Timeline

No history available yet.