Improper access control in Grafana - CVE-2026-33377

Vulnerability identifier: #VU131638

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33377

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on a specific dashboard.

The vulnerability exists due to improper access control in the dashboard import functionality when importing a dashboard with write access to an existing dashboard. A remote user can overwrite a dashboard not owned by them to escalate privileges on that specific dashboard.

The user must have write access to the dashboard to exploit this issue.

Grafana
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
grafana (Red Hat package)
grafana
grafana-selinux
Aruba Networking Private 5G Core

Install security update from vendor's website.

Grafana - addressed in versions 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, 13.0.1+security-01
Aruba Networking Private 5G Core - update to 1.26.1.3
grafana (Red Hat package) - addressed in versions 9.2.10-32.el8_10.1, 10.2.6-23.el9_6, 10.2.6-23.el9_8.2, 10.2.6-28.el10_2.4
grafana - update to 9.2.10-32.0.1
grafana-selinux - update to 9.2.10-32.0.1

• https://grafana.com/security/security-advisories/cve-2026-33377/

• Multiple vulnerabilities in Grafana
• Red Hat Enterprise Linux 10 update for grafana
• Multiple vulnerabilities in HPE Aruba Networking Private 5G Core
• Red Hat Enterprise Linux 8 update for grafana
• Anolis OS update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 9 update for grafana