CVE-2026-33375

Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

El plugin de fuente de datos de Grafana MSSQL contiene un fallo lógico que permite a un usuario con pocos privilegios (Visor) eludir las restricciones de la API y desencadenar un agotamiento catastrófico de la memoria por Out-Of-Memory (OOM), lo que provoca la caída del contenedor anfitrión.

*Credits: N/A

CVSS Scores

Grafana Labsv3.1 6.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2026-03-19 CVE Reserved
2026-03-26 CVE Published
2026-05-13 CVE Updated
2026-05-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://grafana.com/security/security-advisories/cve-2026-33375	2026-03-31

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 11.6.0 < 11.6.14 Search vendor "Grafana" for product "Grafana" and version " >= 11.6.0 < 11.6.14"		-		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 12.1.0 < 12.1.10 Search vendor "Grafana" for product "Grafana" and version " >= 12.1.0 < 12.1.10"		-		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 12.2.0 < 12.2.8 Search vendor "Grafana" for product "Grafana" and version " >= 12.2.0 < 12.2.8"		-		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 12.3.0 < 12.3.6 Search vendor "Grafana" for product "Grafana" and version " >= 12.3.0 < 12.3.6"		-		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 12.4.0 < 12.4.2 Search vendor "Grafana" for product "Grafana" and version " >= 12.4.0 < 12.4.2"		-		Affected