CVE-2026-33374

MediumCVSS 6.5/10Last modified Oct 16, 2026

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770 CWE-789

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Grafana	Grafana Enterprise	>= 12.0.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4
Grafana	Grafana OSS	>= 12.0.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4

References

https://grafana.com/security/security-advisories/cve-2026-33374

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-333756.5The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger CVE-2026-333767.4When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affec CVE-2026-333777.1An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the da CVE-2026-333786.5Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to a CVE-2026-333798.5A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapsh CVE-2026-33387.5Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PK CVE-2026-333806.5A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only insta CVE-2026-333818.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the ev CVE-2026-333827.5Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can CVE-2026-333844.8QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatio CVE-2026-333855.1A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user in CVE-2026-333862.3QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can per