CVE-2026-33382 | Several Grafana API endpoints, some of them unauthenticated,… | CVSS 7.5 HIGH

Description

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Metadata

CVE ID: CVE-2026-33382
State: PUBLISHED
Assigner: GRAFANA
Reserved: 2026-03-19 07:55 UTC
Published: 2026-07-10 14:58 UTC
Last updated: 2026-07-10 18:44 UTC
Primary CWE: CWE-400
CWE-400
Vendor / Product: Grafana / Grafana OSS
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Grafana	Grafana OSS	—	11.6.0 ≤ 11.6.14, 12.2.0 ≤ 12.2.8, 12.3.0 ≤ 12.3.6, 12.4.0 ≤ 12.4.3 …

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (1)

https://grafana.com/security/security-advisories/cve-2026-33382