CVE-2026-33374

MediumCVSS 6.5/10Last modified Oct 16, 2026

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-770CWE-789

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-333756.5The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and triggerCVE-2026-333767.4When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affecCVE-2026-333777.1An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the daCVE-2026-333786.5Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to aCVE-2026-33387.5Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCVE-2026-333806.5A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instaCVE-2026-333818.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the evCVE-2026-333827.5Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker canCVE-2026-333844.8QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatioCVE-2026-333855.1A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user inCVE-2026-333862.3QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perCVE-2026-333874.6A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authe