# CVE-2026-33380: Grafana arbitrary file read in SQL Expressions

Source: https://junglewise.ai/threats/cve-2026-33380-grafana-arbitrary-file-read-in-sql-expressions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-33380 · Severity: medium · CVSS 6.3 · Published 2026-05-13

Grafana is a popular open-source platform used for monitoring and visualizing data. A security vulnerability in its SQL Expressions feature allows a logged-in user to read sensitive files directly from the server's storage. This could lead to the exposure of configuration files, credentials, or other private system data, though it only affects systems where the specific 'sqlExpressions' feature is manually enabled.

Technologies: [github.com/grafana/grafana (Go)](https://junglewise.ai/threats/technologies/github-com-grafana-grafana). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-33380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33380 being exploited in the wild.

**How severe is CVE-2026-33380?** Medium severity, with a CVSS score of 6.3, published 13 May 2026.

**Which products and versions are affected?** github.com/grafana/grafana (Go) < 1.9.2-0.20260513165311-fb7336fc36c1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.2-0.20260513165311-fb7336fc36c1.

**Is there a fix for CVE-2026-33380?** Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260513165311-fb7336fc36c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33380 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33380?** Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260513165311-fb7336fc36c1 or later

  ```sh
  go get github.com/grafana/grafana@v1.9.2-0.20260513165311-fb7336fc36c1
  ```


## Technical details

A vulnerability classified as CWE-552 (Files or Directories Accessible to External Parties) exists in Grafana's SQL Expressions component. The flaw allows an authenticated attacker with low privileges to perform arbitrary file reads from the underlying server filesystem. Exploitation is contingent upon the 'sqlExpressions' feature toggle being enabled. The vulnerability was addressed by implementing stricter access controls and input validation within the SQL expression handling logic. Patches are available in security-specific releases for versions 11.6, 12.2, 12.3, 12.4, and 13.0.

## Affected products

- Grafana Grafana OSS 11.6.0 to 11.6.14, 12.0.0 to 12.2.8, 12.3.0 to 12.3.6, 12.4.0 to 12.4.3, 13.0.0 to 13.0.1

## Identifiers

- CVE-2026-33380
- GHSA-gxcp-jjxh-rwp4
- GO-2026-5409

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: patched
- 2026-05-13: advisory

## References

- [https://grafana.com/security/security-advisories/cve-2026-33380](https://grafana.com/security/security-advisories/cve-2026-33380)
- [https://github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86](https://github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86)

## Related threats

- [Grafana denial of service in public dashboard query endpoint](https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint)
- [Grafana OSS stored XSS in geomap panel XYZ tile layer](https://junglewise.ai/threats/cve-2026-9029-grafana-oss-stored-xss-in-geomap-panel-xyz-tile-layer)
- [Grafana Loki datasource plugin path traversal in callResource handler](https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource)
- [Grafana Tempo and Loki plugins path traversal](https://junglewise.ai/threats/cve-2026-10601-grafana-tempo-and-loki-plugins-path-traversal)
- [Grafana improper access control in service account token minting](https://junglewise.ai/threats/cve-2026-33381-grafana-improper-access-control-in-service-account-token-minting)