CVE-2026-33379

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://grafana.com/security/security-advisories/cve-2026-33379

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://severitydaily.com/grafana-cve-2026-33379-8-5-dashboard-snapshots-viewer-service-account-externally-publish-12-4-4-tagged-june-9-150-days-no-changelog-section-advisory-index-october-27-no-cpe-secondary-only/

Full discourse1 post

Severity Daily@severitydaily1d
Grafana published an 8.5 dashboard-snapshot flaw on Friday. The fix shipped in June, ten patch releases ago, and no release note ever mentioned it. No exploitation reported. https://severitydaily.com/grafana-cve-2026-33379-8-5-dashboard-snapshots-viewer-service-account-externally-publish-12-4-4-tagged-june-9-150-days-no-changelog-section-advisory-index-october-27-no-cpe-secondary-only/
0000030
34 followersView on X

Explore more

Back to dashboard