EUVD-2026-16351Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.
AnalysisAI
Grafana MSSQL data source plugin versions across multiple release branches contain a logic flaw enabling low-privileged Viewer users to bypass API restrictions and trigger catastrophic out-of-memory exhaustion, resulting in host container denial of service. The vulnerability affects Grafana OSS versions 11.6.0 through 12.4.0 across multiple patch branches (11.6.14+security-01, 12.1.10+security-01, 12.2.8+security-01, 12.3.6+security-01, and 12.4.2 or later) and requires only network access and valid low-privileged credentials to exploit; no public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The vulnerability resides in the Grafana MSSQL data source plugin (cpe:2.3:a:grafana:grafana_oss), a database connectivity module that allows Grafana instances to query Microsoft SQL Server data sources. The flaw represents a privilege escalation and authorization bypass mechanism: authenticated users with only Viewer-level permissions (the lowest privilege tier in Grafana's role-based access control model) can invoke API endpoints or plugin functionality that should be restricted to higher-privilege roles. The logic flaw does not properly enforce role-based access controls when processing MSSQL queries, allowing Viewer users to craft requests that exhaust memory resources. The root cause involves improper input validation or resource allocation limits within the plugin's query handling logic, though specific CWE classification was not provided in the vulnerability data.
RemediationAI
Upgrade Grafana OSS to patched versions: 11.6.14+security-01 or later (for 11.6.x branch), 12.1.10+security-01 or later (for 12.1.x branch), 12.2.8+security-01 or later (for 12.2.x branch), 12.3.6+security-01 or later (for 12.3.x branch), or 12.4.2 or later (for 12.4.x branch). Consult https://grafana.com/security/security-advisories/cve-2026-33375 for release notes and upgrade procedures. As an interim mitigation pending patching, restrict network access to Grafana instances to trusted administrative networks only, enforce multi-factor authentication for all user accounts (especially those with Viewer or higher roles), disable or isolate the MSSQL data source plugin if not actively required, and monitor container memory utilization for anomalous spikes that may indicate exploit attempts. Implement API rate limiting on database query endpoints if possible through reverse proxy configuration.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today