SQL Injection Vulnerability in Grafana by Grafana Labs
CVE-2026-33380

6.3MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Oss
Vendor
CVE Published:
13 May 2026

What is CVE-2026-33380?

An SQL injection vulnerability exists in Grafana's SQL Expressions feature. This flaw enables authenticated attackers to read arbitrary files from the server's filesystem, particularly in instances where the sqlExpressions feature toggle is enabled. This could lead to unauthorized access to sensitive data, highlighting the importance of disabling this feature when not in use and applying necessary security measures.

Affected Version(s)

Grafana OSS OnPrem 11.6.0 <= 11.6.14

Grafana OSS OnPrem 11.6.14 < 11.6.14+security-04

Grafana OSS OnPrem 12.0.0 <= 12.2.8

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.