Security readout for executives and security teams
Plain-English summary
A flaw in Grafana's SQL Expressions feature lets a logged-in user read files from the Grafana server. Only installations that have turned on the sqlExpressions feature toggle are exposed. There is no report of active exploitation, but any organization running Grafana with this experimental feature enabled should review access and apply vendor guidance.
Executive priority
Treat as a moderate, planned-patch item unless your Grafana runs the sqlExpressions toggle and is broadly accessible to authenticated users, in which case accelerate patching and access review. No active exploitation is reported, but the flaw can leak secrets that enable larger incidents.
Technical view
Grafana's SQL Expressions processing (CWE-552, files accessible to external parties) allows an authenticated user to coerce the server into reading arbitrary files from its filesystem. CVSS 3.1 base is 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting network reach, low privileges, high attack complexity, and confidentiality-only impact with scope change. Exposure requires the sqlExpressions feature toggle to be enabled.
Likely exposure
Applies to Grafana OSS instances where the sqlExpressions feature toggle is enabled across the listed 11.6.x, 12.0.x–12.4.x, and 13.0.x lines. Instances that never enabled the toggle are not vulnerable. Internet-exposed Grafana with SSO or self-registration expands the pool of authenticated users who could trigger the read.
Exploitation context
Not listed in CISA KEV and no public reports of in-the-wild exploitation are cited in the bundle. The vector requires prior authentication and high attack complexity, but the outcome is disclosure of any file readable by the Grafana process, which can include configuration, tokens, and secrets useful for follow-on attacks.
Researcher notes
CWE-552 with scope change and C:H suggests the read runs in the Grafana server context, so any file the process can open is in play, including datasource credentials and API keys. High attack complexity likely reflects conditions around SQL Expression construction. The advisory lists paired version boundaries (e.g., 11.6.0/11.6.14), consistent with vulnerable-through-fixed ranges; confirm the exact fixed build from the vendor page before closing tickets.
Mitigation direction
- Consult the Grafana security advisory for CVE-2026-33380 and apply the vendor's recommended fixed release.
- Disable the sqlExpressions feature toggle on Grafana instances that do not require it.
- Restrict Grafana authentication to trusted users and enforce least-privilege roles.
- Place Grafana behind SSO, VPN, or network controls to limit anonymous or broad access.
- Rotate credentials, tokens, and secrets accessible to the Grafana service account if exposure is suspected.
Validation and detection
- Inventory Grafana OSS deployments and record versions against the affected 11.6.x, 12.x, and 13.0.x ranges.
- Check each instance's feature_toggles configuration for sqlExpressions being enabled.
- Confirm the running build matches a Grafana-published fixed version after upgrade.
- Review Grafana access, audit, and query logs for unusual SQL Expression usage by low-privilege accounts.
- Verify file permissions on the Grafana host limit what the service account can read.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-552: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-33380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N1.84GRAFANAVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-33380CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.