CVE-2026-33375
Fixed in a distro release EPSS <1%CVSS 6.5
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.
Products: Grafana OSS
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r0 |
| Chainguard | grafana-fips-12.2 | 12.2.8.01-r0 |
| Chainguard | grafana-fips-12.3 | 12.3.6.01-r0 |
| openSUSE Leap 16.0 | grafana | 11.6.14+security04-bp160.1.1 |
| openSUSE Tumbleweed | grafana | 11.6.14+security01-1.1 |