Grafana OSS CVE-2026-33380

Exploitation requires two concurrent conditions: first, the sqlExpressions feature toggle must be explicitly enabled in the Grafana instance configuration - this is a non-default setting that must be deliberately activated by an administrator; second, the attacker must hold a valid authenticated Grafana account with at least low-privilege access (PR:L per CVSS vector). High attack complexity (AC:H) further limits exploitation, indicating that additional conditions beyond basic authentication are required - this may involve specific query construction techniques or race conditions not fully detailed in available data. What limits exploitation: the sqlExpressions toggle is not enabled by default, meaning the vast majority of Grafana deployments are not vulnerable; unauthenticated attackers cannot exploit this; the impact is read-only (no write or code execution). Grafana instances with sqlExpressions disabled are confirmed not vulnerable per the vendor advisory.

The CVSS 6.3 score reflects meaningful but bounded risk: the network attack vector (AV:N) confirms remote reachability, but high attack complexity (AC:H) and low privilege requirement (PR:L) together indicate exploitation is not trivial and requires an authenticated session plus non-default configuration. The scope change (S:C) with C:H, I:N, A:N signals pure confidentiality impact - no write or denial-of-service capability. Critically, the vulnerability only manifests when the sqlExpressions feature toggle is explicitly enabled, which is a non-default configuration, substantially reducing the exposed population. EPSS is 0.03% (9th percentile), indicating that exploitation probability in the next 30 days is very low relative to the broader CVE corpus. SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) aligns with EPSS - this is not a high-urgency mass-exploitation scenario. Real-world risk is moderate-to-low for most organizations: instances not using SQL Expressions are entirely unaffected, and even where the toggle is enabled, an attacker must first obtain an authenticated account. Priority patching is warranted for internet-facing Grafana deployments with sqlExpressions enabled.

An attacker with a valid low-privilege Grafana account on an instance where the sqlExpressions feature toggle has been enabled crafts a malicious SQL expression referencing a sensitive filesystem path (such as /etc/passwd or application secret files) and submits it through the Grafana query interface or API. The server evaluates the expression and returns the file contents in the query response, allowing the attacker to systematically enumerate and exfiltrate sensitive server-side files. No public proof-of-concept code has been identified at time of analysis, but the attack surface is well-understood given the path traversal classification.