Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
6 versions affected across 1 product
CVE-2026-33376 When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, a… https://www.cve.org/CVERecord?id=CVE-2026-33376
Post summary
The disclosure details how the Auth Proxy IPv6 allow‑list defaults to /32 addresses, making it vulnerable unless an explicit mask is set. No exploit, PoC, or patch information is provided.
10 of 10 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | grafana | grafana | - | - | - |
| App | grafana | grafana | 11.6.14 | - | - |
| App | grafana | grafana | 11.6.14 | - | - |
| App | grafana | grafana | 12.2.8 | - | - |
| App | grafana | grafana | 12.2.8 | - | - |
| App | grafana | grafana | 12.3.6 | - | - |
| App | grafana | grafana | 12.3.6 | - | - |
| App | grafana | grafana | 12.4.3 | - | - |
| App | grafana | grafana | 13.0.0 | - | - |
| App | grafana | grafana | 13.0.1 | - | - |