EUVD-2026-30142
GHSA-3r2p-7499-27q3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
AnalysisAI
Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions because the feature applies a /32 default mask to IPv6 addresses instead of the appropriate /128, dramatically widening the trusted address space and potentially admitting unauthorized clients into authenticated sessions. The flaw is confined to the Auth Proxy authentication path - Okta, SAML, and LDAP integrations are unaffected - and at this time there is no public exploit identified at time of analysis, with EPSS at 0.03% and SSVC marking exploitation as 'none.'
Technical ContextAI
Grafana's Auth Proxy feature trusts upstream reverse proxies to assert authenticated user identity via headers, gated by an IP allow-list of permitted proxy addresses. The underlying defect is CWE-1188 (Insecure Default Initialization of Resource): when an operator lists a bare IPv6 address without an explicit CIDR mask, Grafana applies the IPv4-appropriate /32 default instead of the IPv6 host mask /128. Because /32 in IPv6 space covers 2^96 addresses, the configured 'single-host' entry silently expands to an enormous network range, allowing any host within that range to be treated as a trusted Auth Proxy origin. The CPE confirms only grafana:grafana_oss is in scope.
RemediationAI
Vendor-released patches are available - upgrade Grafana OSS to 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, or 13.0.1+security-01 depending on your release line, per the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-33376. As an immediate workaround that does not require a restart of the upgrade window, edit the Auth Proxy allow-list and append an explicit mask (typically /128) to every IPv6 entry so the configured host is interpreted literally; this fully neutralizes the default-mask flaw with no functional side effect beyond a config edit. If patching is delayed and a mask change is not feasible, consider temporarily disabling the Auth Proxy provider and falling back to Okta, SAML, or LDAP (which are confirmed unaffected), accepting that this changes the operator login flow and may require updating reverse-proxy routing.
More in Grafana Oss
View allPrivilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to o
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (O
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory b
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sendin
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to t
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlE
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete ar
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test e
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, re
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today