CVE-2026-33380

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-333818.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the ev CVE-2026-333827.5Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can CVE-2026-333844.8QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatio CVE-2026-333855.1A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user in CVE-2026-333862.3QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can per CVE-2026-333874.6A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authe CVE-2026-333887.4An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A CVE-2026-333897.5An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted con CVE-2026-33392.7The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_CVE-2026-333908.1An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permiss CVE-2026-333915.4An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privi CVE-2026-333927.2In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass