Security readout for executives and security teams
Plain-English summary
An authenticated Grafana user may be able to read arbitrary files stored on the Grafana server. Exposure is limited to specified Grafana OSS releases where the sqlExpressions feature toggle is enabled. Stolen configuration, credentials, or other sensitive files could enable broader compromise, although this vulnerability does not directly modify data or disrupt service.
Executive priority
Prioritize prompt review rather than emergency shutdown. Act faster where affected Grafana instances are internet-accessible, broadly shared, or store readable credentials. Confirm configuration and version first; escalate incident response if suspicious authenticated activity or possible secret exposure is found.
Technical view
CVE-2026-33380 is a CWE-552 arbitrary file-read vulnerability in Grafana SQL Expressions. It is remotely reachable, requires low privileges, has high attack complexity, and needs no user interaction. CVSS 3.1 scores it 6.3 with high confidentiality impact, no direct integrity or availability impact, and changed scope.
Likely exposure
Likely exposure is limited to Grafana OSS 11.6.0, 11.6.14, 12.0.0, 12.2.8, 12.3.0, 12.3.6, 12.4.0, 12.4.3, 13.0.0, and 13.0.1 when sqlExpressions is enabled. An attacker must already possess authenticated access.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not identified as KEV. Exploitation requires authentication and high complexity, reducing likelihood, but successful access could expose sensitive server files. No public exploit details should be inferred from this bundle.
Researcher notes
The narrow prerequisite is important: affected release plus enabled sqlExpressions plus authenticated attacker. The changed-scope vector indicates file disclosure may affect resources beyond the vulnerable component's security authority. The bundle does not name fixed versions, patches, detection signatures, or confirmed exploitation; consult the vendor advisory for current remediation details.
Mitigation direction
- Identify affected Grafana OSS versions and whether sqlExpressions is enabled.
- If operationally acceptable, disable sqlExpressions while reviewing Grafana's advisory.
- Restrict authenticated Grafana access to trusted users and networks.
- Follow Grafana's current vendor guidance for supported remediation or fixed releases.
- Rotate exposed secrets if investigation indicates sensitive files may have been read.
Validation and detection
- Record the deployed Grafana OSS version for every instance.
- Confirm the effective sqlExpressions feature-toggle state on each instance.
- Review authenticated access and SQL Expressions usage for suspicious activity.
- Determine whether Grafana can access configuration files, credentials, tokens, or other sensitive data.
- After remediation, confirm sqlExpressions is disabled or vendor-recommended remediation is applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-552: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-33380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N1.84GRAFANAVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-33380CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.