Is CVE-2026-33380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33380 being exploited in the wild.

How severe is CVE-2026-33380?

Medium severity, with a CVSS score of 6.3, published 13 May 2026.

Which products and versions are affected?

github.com/grafana/grafana (Go) < 1.9.2-0.20260513165311-fb7336fc36c1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.2-0.20260513165311-fb7336fc36c1.

Is there a fix for CVE-2026-33380?

Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260513165311-fb7336fc36c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33380 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33380?

Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33380: Grafana arbitrary file read in SQL Expressions

Q: Is there a fix for CVE-2026-33380?

Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260513165311-fb7336fc36c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33380 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33380?

Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33380 · Severity: medium · CVSS 6.3 · Published 2026-05-13

Grafana is a popular open-source platform used for monitoring and visualizing data. A security vulnerability in its SQL Expressions feature allows a logged-in user to read sensitive files directly from the server's storage. This could lead to the exposure of configuration files, credentials, or other private system data, though it only affects systems where the specific 'sqlExpressions' feature is manually enabled.

Technologies: github.com/grafana/grafana (Go). Vendors: Go.

Quick answers

Is CVE-2026-33380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33380 being exploited in the wild.
How severe is CVE-2026-33380?: Medium severity, with a CVSS score of 6.3, published 13 May 2026.
Which products and versions are affected?: github.com/grafana/grafana (Go) < 1.9.2-0.20260513165311-fb7336fc36c1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.2-0.20260513165311-fb7336fc36c1.
Is there a fix for CVE-2026-33380?: Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260513165311-fb7336fc36c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33380 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33380?: Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260513165311-fb7336fc36c1 or later
```
go get github.com/grafana/grafana@v1.9.2-0.20260513165311-fb7336fc36c1
```

Technical details

A vulnerability classified as CWE-552 (Files or Directories Accessible to External Parties) exists in Grafana's SQL Expressions component. The flaw allows an authenticated attacker with low privileges to perform arbitrary file reads from the underlying server filesystem. Exploitation is contingent upon the 'sqlExpressions' feature toggle being enabled. The vulnerability was addressed by implementing stricter access controls and input validation within the SQL expression handling logic. Patches are available in security-specific releases for versions 11.6, 12.2, 12.3, 12.4, and 13.0.

Affected products

Grafana Grafana OSS 11.6.0 to 11.6.14, 12.0.0 to 12.2.8, 12.3.0 to 12.3.6, 12.4.0 to 12.4.3, 13.0.0 to 13.0.1

Identifiers

CVE-2026-33380
GHSA-gxcp-jjxh-rwp4
GO-2026-5409

Timeline

2026-05-13: disclosed
2026-05-13: patched
2026-05-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.