Improper access control in Grafana - CVE-2026-33377

Vulnerability identifier: #VU131638

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33377

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on a specific dashboard.

The vulnerability exists due to improper access control in the dashboard import functionality when importing a dashboard with write access to an existing dashboard. A remote user can overwrite a dashboard not owned by them to escalate privileges on that specific dashboard.

The user must have write access to the dashboard to exploit this issue.

Grafana
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Aruba Networking Private 5G Core
grafana (Red Hat package)
grafana
grafana-selinux

Install security update from vendor's website.

Grafana - addressed in versions 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, 13.0.1+security-01
Aruba Networking Private 5G Core - update to 1.26.1.3
grafana (Red Hat package) - addressed in versions 9.2.10-32.el8_10.1, 10.2.6-28.el10_2.4
grafana - update to 9.2.10-32.0.1
grafana-selinux - update to 9.2.10-32.0.1

• https://grafana.com/security/security-advisories/cve-2026-33377/

• Multiple vulnerabilities in Grafana
• Red Hat Enterprise Linux 10 update for grafana
• Multiple vulnerabilities in HPE Aruba Networking Private 5G Core
• Red Hat Enterprise Linux 8 update for grafana
• Anolis OS update for grafana