Vulnerability-Lookup

CVE-2026-33377 (GCVE-0-2026-33377)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:28 – Updated: 2026-08-27 17:22

Title

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

Summary

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-16 03:55 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Grafana	Grafana OSS	Affected: 8.5.0 , ≤ 11.6.14 (semver) Affected: 11.6.14 , < 11.6.14+security-04 (custom) Affected: 12.0.0 , ≤ 12.2.8 (semver) Affected: 12.2.8 , < 12.2.8+security-04 (custom) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.3.6 , < 12.3.6+security-04 (custom) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 12.4.3 , < 12.4.3+security-02 (custom) Affected: 13.0.0 , ≤ 13.0.1 (semver) Affected: 13.0.1 , < 13.0.1+security-01 (custom)	guessed

Date Public

2026-05-13 07:44

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-16T03:55:59.661383Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T18:33:09.317Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-13T07:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:22:32.185Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Dashboard Import Overwrites ACL \u2014 Editor Privilege Escalation to Dashboard Admin",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33377",
    "datePublished": "2026-05-13T19:28:28.154Z",
    "dateReserved": "2026-03-19T07:55:06.977Z",
    "dateUpdated": "2026-08-27T17:22:32.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33377",
      "date": "2026-09-19",
      "epss": "0.00226",
      "percentile": "0.13543"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Grafana OSS",
                "vendor": "Grafana",
                "versions": [
                  {
                    "lessThanOrEqual": "11.6.14",
                    "status": "affected",
                    "version": "8.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "11.6.14+security-04",
                    "status": "affected",
                    "version": "11.6.14",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "12.2.8",
                    "status": "affected",
                    "version": "12.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.2.8+security-04",
                    "status": "affected",
                    "version": "12.2.8",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "12.3.6",
                    "status": "affected",
                    "version": "12.3.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.3.6+security-04",
                    "status": "affected",
                    "version": "12.3.6",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "12.4.3",
                    "status": "affected",
                    "version": "12.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.4.3+security-02",
                    "status": "affected",
                    "version": "12.4.3",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "13.0.1",
                    "status": "affected",
                    "version": "13.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "13.0.1+security-01",
                    "status": "affected",
                    "version": "13.0.1",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@grafana.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3EB52192-B43E-44FD-A838-245DD579DF4E",
                    "versionEndExcluding": "11.6.14",
                    "versionStartIncluding": "8.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0",
                    "versionEndExcluding": "12.2.8",
                    "versionStartIncluding": "12.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5",
                    "versionEndExcluding": "12.3.6",
                    "versionStartIncluding": "12.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A",
                    "versionEndExcluding": "12.4.3",
                    "versionStartIncluding": "12.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
                    "matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
                    "matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
                    "matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
                    "matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
                    "matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
                    "matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
                    "matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*",
                    "matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
          }
        ],
        "id": "CVE-2026-33377",
        "lastModified": "2026-06-17T13:20:16.610",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security@grafana.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33377",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-16T03:55:59.661383Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-13T20:16:20.470",
        "references": [
          {
            "source": "security@grafana.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
          }
        ],
        "sourceIdentifier": "security@grafana.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-284"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-18T11:28:51+00:00",
      "cve": "CVE-2026-33377",
      "id": "CVE-2026-33377",
      "initial_release_date": "2026-05-13T19:28:28.154000+00:00",
      "product_status:fixed": "121",
      "product_status:known_affected": "8",
      "product_status:known_not_affected": "635",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana: Grafana: Privilege escalation via dashboard overwrite",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33377.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-27T00:29:44Z",
      "cve": "CVE-2026-33377",
      "id": "CVE-2026-33377",
      "initial_release_date": "2026-05-15T01:59:31Z",
      "product_status:known_not_affected": "1",
      "product_status:recommended": "72",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-33377",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-33377.json",
      "version": "9"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33377",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-16T03:55:59.661383Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-284",
                    "description": "CWE-284 Improper Access Control",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-14T18:09:25.878Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Grafana OSS",
              "vendor": "Grafana",
              "versions": [
                {
                  "lessThanOrEqual": "11.6.14",
                  "status": "affected",
                  "version": "8.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "11.6.14+security-04",
                  "status": "affected",
                  "version": "11.6.14",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "12.2.8",
                  "status": "affected",
                  "version": "12.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.2.8+security-04",
                  "status": "affected",
                  "version": "12.2.8",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "12.3.6",
                  "status": "affected",
                  "version": "12.3.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.3.6+security-04",
                  "status": "affected",
                  "version": "12.3.6",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "12.4.3",
                  "status": "affected",
                  "version": "12.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.4.3+security-02",
                  "status": "affected",
                  "version": "12.4.3",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "13.0.1",
                  "status": "affected",
                  "version": "13.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "13.0.1+security-01",
                  "status": "affected",
                  "version": "13.0.1",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "datePublic": "2026-05-13T07:44:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T08:50:20.236Z",
            "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
            "shortName": "GRAFANA"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
            }
          ],
          "source": {
            "discovery": "BUG_BOUNTY"
          },
          "title": "Dashboard Import Overwrites ACL \u2014 Editor Privilege Escalation to Dashboard Admin",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "assignerShortName": "GRAFANA",
        "cveId": "CVE-2026-33377",
        "datePublished": "2026-05-13T19:28:28.154Z",
        "dateReserved": "2026-03-19T07:55:06.977Z",
        "dateUpdated": "2026-08-26T08:50:20.236Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ALSA-2026:54178

Vulnerability from osv_almalinux – Published: 2026-08-12 00:00 – Updated: 2026-08-13 08:05 – Source website

Summary

Moderate: grafana security, bug fix, and enhancement update

Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)
grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)
grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

[grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:54178	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-33376	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33377	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33382	REPORT
	https://access.redhat.com/security/cve/CVE-2026-8609	REPORT
	https://bugzilla.redhat.com/2477246	REPORT
	https://bugzilla.redhat.com/2477262	REPORT
	https://bugzilla.redhat.com/2499061	REPORT
	https://bugzilla.redhat.com/2499062	REPORT
	https://errata.almalinux.org/10/ALSA-2026-54178.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-28.el10_2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "grafana-selinux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-28.el10_2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n  * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n  * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)\n  * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:54178",
  "modified": "2026-08-13T08:05:33Z",
  "published": "2026-08-12T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:54178"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33376"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33377"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33382"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-8609"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2477246"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2477262"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2499061"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2499062"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-54178.html"
    }
  ],
  "related": [
    "CVE-2026-33377",
    "CVE-2026-33376",
    "CVE-2026-8609",
    "CVE-2026-33382"
  ],
  "summary": "Moderate: grafana security, bug fix, and enhancement update"
}

ALSA-2026:58982

Vulnerability from osv_almalinux – Published: 2026-08-24 00:00 – Updated: 2026-08-26 13:59 – Source website

Summary

Moderate: grafana security, bug fix, and enhancement update

Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

Bug Fix(es) and Enhancement(s):

Avoid unbounded memory growth [almalinux-9.8.z] (JIRA:AlmaLinux-242865)
Limit the size of the request body before processing it (JIRA:AlmaLinux-242866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:58982	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-33376	REPORT
	https://access.redhat.com/security/cve/CVE-2026-33377	REPORT
	https://bugzilla.redhat.com/2477246	REPORT
	https://bugzilla.redhat.com/2477262	REPORT
	https://errata.almalinux.org/9/ALSA-2026-58982.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-23.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "grafana-selinux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-23.el9_8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n  * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Avoid unbounded memory growth [almalinux-9.8.z] (JIRA:AlmaLinux-242865)\n  * Limit the size of the request body before processing it (JIRA:AlmaLinux-242866)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:58982",
  "modified": "2026-08-26T13:59:07Z",
  "published": "2026-08-24T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:58982"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33376"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33377"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2477246"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2477262"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-58982.html"
    }
  ],
  "related": [
    "CVE-2026-33377",
    "CVE-2026-33376"
  ],
  "summary": "Moderate: grafana security, bug fix, and enhancement update"
}

BDU:2026-07034 (CVE-2026-33377)

Vulnerability from fstec – Published: 2026-05-19 – Updated: 2026-07-20 – View on bdu.fstec.ru Fixed

Title

Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с перезаписью списков контроля доступа, позволяющая нарушителю повысить свои привилегии

Summary

Уязвимость платформы для мониторинга и наблюдения Grafana связана с перезаписью списков контроля доступа в результате импорта данных из панели мониторинга. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:P/I:C/A:N

7.1 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-284 - Неправильный контроль доступа

Aliases

CVE-2026-33377

References

2 references

URL
https://grafana.com/security/security-advisories/cve-2026-33377
http://repo.red-soft.ru/redos/8.0/x86_64/updates/

Impacted products

2 products from 2 vendors

Vendors

ООО «Ред Софт», Grafana Labs

Products

РЕД ОС (запись в едином реестре российских программ №3751), Grafana

Versions

8.0 (РЕД ОС), до 11.6.14+security-04 (Grafana), от 12.2.0 до 12.2.8+security-04 (Grafana), от 12.3.0 до 12.3.6+security-04 (Grafana), от 12.4.0 до 12.4.3+security-02 (Grafana), от 13.0.0 до 13.0.1+security-01 (Grafana)

Product types

Operating system, Application software

Platforms

ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751)

Mitigations

Использование рекомендаций: https://grafana.com/security/security-advisories/cve-2026-33377 Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:C/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, Grafana Labs",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "8.0 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 11.6.14+security-04 (Grafana), \u043e\u0442 12.2.0 \u0434\u043e 12.2.8+security-04 (Grafana), \u043e\u0442 12.3.0 \u0434\u043e 12.3.6+security-04 (Grafana), \u043e\u0442 12.4.0 \u0434\u043e 12.4.3+security-02 (Grafana), \u043e\u0442 13.0.0 \u0434\u043e 13.0.1+security-01 (Grafana)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://grafana.com/security/security-advisories/cve-2026-33377\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: \nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.05.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.07.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "19.05.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-07034",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-33377",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Grafana",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f Grafana, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (CWE-284)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f Grafana \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0438\u043c\u043f\u043e\u0440\u0442\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0430\u043d\u0435\u043b\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://grafana.com/security/security-advisories/cve-2026-33377\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-284",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,1)"
}

bit-grafana-2026-33377

Vulnerability from bitnami_vulndb

Published

2026-05-15 08:42

Modified

2026-09-08 08:34

Summary

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

Details

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "grafana",
        "purl": "pkg:bitnami/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "11.6.14"
            },
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.2.8"
            },
            {
              "introduced": "12.3.0"
            },
            {
              "fixed": "12.3.6"
            },
            {
              "introduced": "12.4.0"
            },
            {
              "fixed": "12.4.3"
            },
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.0.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33377"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*"
    ],
    "severity": "High"
  },
  "details": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.",
  "id": "BIT-grafana-2026-33377",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-05-15T08:42:45.411Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Dashboard Import Overwrites ACL \u2014 Editor Privilege Escalation to Dashboard Admin"
}

CERTFR-2026-AVI-0989

Vulnerability from certfr_avis - Published: 2026-08-10 - Updated: 2026-08-10

De multiples vulnérabilités ont été découvertes dans HPE Aruba Networking Private 5G Core. Elles permettent à un attaquant de provoquer une élévation de privilèges et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	HPE Aruba Networking	Private 5G Core	Private 5G Core versions antérieures à 1.26.1.3

References

Title

Publication Time

FKIE_CVE-2026-33377

Vulnerability from fkie_nvd - Published: 2026-05-13 20:16 - Updated: 2026-06-17 13:20

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Summary

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

References

	URL	Tags
	security@grafana.com	https://grafana.com/security/security-advisories/cve-2026-33377	Vendor Advisory

Impacted products

Vendor	Product	Version
grafana	grafana	*
grafana	grafana	*
grafana	grafana	*
grafana	grafana	*
grafana	grafana	11.6.14
grafana	grafana	11.6.14
grafana	grafana	12.2.8
grafana	grafana	12.2.8
grafana	grafana	12.3.6
grafana	grafana	12.3.6
grafana	grafana	12.4.3
grafana	grafana	13.0.0
grafana	grafana	13.0.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.14+security-04",
              "status": "affected",
              "version": "11.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.8+security-04",
              "status": "affected",
              "version": "12.2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.6+security-04",
              "status": "affected",
              "version": "12.3.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.3+security-02",
              "status": "affected",
              "version": "12.4.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.1+security-01",
              "status": "affected",
              "version": "13.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@grafana.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3EB52192-B43E-44FD-A838-245DD579DF4E",
              "versionEndExcluding": "11.6.14",
              "versionStartIncluding": "8.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0",
              "versionEndExcluding": "12.2.8",
              "versionStartIncluding": "12.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5",
              "versionEndExcluding": "12.3.6",
              "versionStartIncluding": "12.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A",
              "versionEndExcluding": "12.4.3",
              "versionStartIncluding": "12.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
              "matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
              "matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
              "matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
              "matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
              "matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
              "matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
    }
  ],
  "id": "CVE-2026-33377",
  "lastModified": "2026-06-17T13:20:16.610",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security@grafana.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33377",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-16T03:55:59.661383Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-13T20:16:20.470",
  "references": [
    {
      "source": "security@grafana.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
    }
  ],
  "sourceIdentifier": "security@grafana.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-5CV7-H7GR-WJGH

Vulnerability from github – Published: 2026-05-13 21:32 – Updated: 2026-05-13 21:32

Details

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-33377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-13T20:16:20Z",
    "severity": "HIGH"
  },
  "details": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.",
  "id": "GHSA-5cv7-h7gr-wjgh",
  "modified": "2026-05-13T21:32:06Z",
  "published": "2026-05-13T21:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:10932-1

Vulnerability from csaf_opensuse - Published: 2026-06-02 00:00 - Updated: 2026-06-02 00:00

Summary

grafana-11.6.14+security04-1.1 on GA media

Severity

Moderate

Scope

10 vulnerabilities in this advisory, including CVE-2026-33377.

CVE-2026-33377

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Recommended: 4 products

Open the full advisory

RHSA-2026:42852

Vulnerability from csaf_redhat - Published: 2026-07-21 14:36 - Updated: 2026-09-20 02:19

Summary

Red Hat Security Advisory: Multicluster Global Hub 1.5.6 security update

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2026-33377.

CVE-2026-33377

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fixed: 4 products Known not affected: 17 products

https://access.redhat.com/errata/RHSA-2026:42852

Open the full advisory

RHSA-2026:44622

Vulnerability from csaf_redhat - Published: 2026-07-23 18:36 - Updated: 2026-09-20 02:19

Summary

Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update

Severity

Important

Scope

16 vulnerabilities in this advisory, including CVE-2026-33377.

CVE-2026-33377

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fixed: 4 products Known not affected: 17 products

https://access.redhat.com/errata/RHSA-2026:44622

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33377 (GCVE-0-2026-33377)

BDU:2026-07034 (CVE-2026-33377)

Vulnerability from bitnami_vulndb

Solutions

Tags

Sightings

Nomenclature

Related by attack behaviour