Medium severity6.3NVD Advisory· Published May 13, 2026· Updated Jun 16, 2026

CVE-2026-33380

Description

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/grafana/grafanaGo	< 1.9.2-0.20260513165311-fb7336fc36c1	1.9.2-0.20260513165311-fb7336fc36c1

Affected products

Grafana/Grafanallm-fuzzy
osv-coords6 versions
pkg:apk/chainguard/grafana-12.4 pkg:apk/chainguard/grafana-fips-12.4 pkg:apk/wolfi/grafana-12.4 pkg:bitnami/grafana pkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
< 12.4.3.02-r0+ 5 more
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: < 12.4.4-r0
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: >= 11.6.0, < 11.6.14
- (no CPE)range: < 11.6.14+security04-bp160.1.1
- (no CPE)range: < 11.6.14+security04-1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-gxcp-jjxh-rwp4ghsaADVISORY
grafana.com/security/security-advisories/cve-2026-33380nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-33380ghsaADVISORY
github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000