Grafana CVE-2026-33375

The CVSS 3.1 score of 6.5 (Medium-High) reflects a network-accessible vulnerability requiring low-privilege authentication, with high availability impact but no confidentiality or integrity compromise. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms that an authenticated attacker with minimal privileges and no user interaction can remotely trigger a denial-of-service condition. This represents moderate real-world risk: the attack vector is network-accessible and does not require system-level access, but the requirement for valid Viewer credentials limits the attack surface to environments where such accounts are provisioned. The absence of reported active exploitation (no CISA KEV status or POC availability noted) and the fact that this affects only the MSSQL plugin (not core Grafana) reduce immediate urgency compared to unauth vulnerabilities, but the ease of exploitation (low complexity, low privilege requirement) and high technical impact (container crash) warrant prioritized patching within scheduled maintenance windows. Organizations running Grafana with many low-privileged users or exposed Viewer accounts face elevated risk.

An attacker with valid Grafana Viewer credentials (e.g., obtained through credential compromise or provisioned by default in a shared environment) logs into a Grafana instance and crafts a malicious request to the MSSQL plugin API that exploits the authorization bypass and triggers unbounded memory allocation during query processing. The request does not require user interaction and exploits the logic flaw to allocate progressively larger memory buffers until the host container exhausts available RAM, causing the Grafana process to be killed by the operating system's out-of-memory killer, resulting in service unavailability. Recovery requires manual container restart. No public exploit code or active exploitation in the wild has been identified at the time of this analysis.