CVE-2026-33380
Fixed in a distro release EPSS <1%CVSS 6.3
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
Products: Grafana OSS
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 1.9.2-0.20260513165311-fb7336fc36c1 |
| Go | github.com/grafana/grafana | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.4 | 12.4.3.02-r0 |
| Chainguard | grafana-fips-11.6 | 11.6.16-r1 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | 12.2.10-r0 |
| Chainguard | grafana-fips-12.3 | 12.3.8-r3 |
| Chainguard | grafana-fips-12.4 | 12.4.4-r0 |
| Chainguard | grafana-fips-13.0 | 13.0.3-r3 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.10-0.6.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.6-0.1.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.5.hum1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 12.4.5-150200.3.91.1 |
| SUSE Multi Linux Manager Tools SLE-15 | dracut-saltboot | 1.2.1-150002.3.9.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150002.3.6.2 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-boynux-squid_exporter | 1.13.0-150002.3.6.2 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.9.2 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.11.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.3-150002.3.13.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security04-150002.4.21.1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.4-150002.3.9.1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.11.1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-postgres_exporter | 0.10.1-150002.3.3.2 |
| SUSE Multi Linux Manager Tools SLE-15 | python-defusedxml-sle15 | 0.7.1-150002.1.3.1 |
| SUSE Multi Linux Manager Tools SLE-15 | rhnlib | 5.2.5-150002.3.9.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.8-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.6-150002.3.9.1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-salt | 1.2.3-150002.3.3.1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-susemanager-client | 5.2.3-150002.3.9.1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-common-libs | 5.2.5-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.12-150002.3.17.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | dracut-saltboot | 1.2.1-150002.3.9.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.12-150002.3.17.1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image | 5.1.4-8.22.22 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image | 5.1.4-9.20.25 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-proxy-squid-image | 5.1.4-8.20.11 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image | 5.1.4-8.22.22 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image | 5.1.4-9.20.25 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image | 5.1.4-8.20.11 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-httpd-image | 5.1.4-8.22.22 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image | 5.1.4-9.20.25 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-squid-image | 5.1.4-8.20.11 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-ssh-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image | 5.1.4-8.22.22 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image | 5.1.4-9.20.25 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-proxy-squid-image | 5.1.4-8.20.11 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-server-attestation-image | 5.1.4-8.22.10 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-server-image | 5.1.4-8.20.34 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-server-postgresql-image | 5.1.4-6.24.3 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-aarch64-server-saline-image | 5.1.4-9.20.24 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-server-attestation-image | 5.1.4-8.22.10 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-server-image | 5.1.4-8.20.34 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image | 5.1.4-6.24.3 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-ppc64le-server-saline-image | 5.1.4-9.20.24 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-attestation-image | 5.1.4-8.22.10 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-image | 5.1.4-8.20.34 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-postgresql-image | 5.1.4-6.24.3 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-saline-image | 5.1.4-9.20.24 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-server-attestation-image | 5.1.4-8.22.10 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image | 5.1.4-8.20.12 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-server-image | 5.1.4-8.20.34 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image | 5.1.4-8.20.13 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-server-postgresql-image | 5.1.4-6.24.3 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-x86_64-server-saline-image | 5.1.4-9.20.24 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| Wolfi | grafana-12.4 | 12.4.3.02-r0 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Leap 16.0 | grafana | 11.6.14+security04-bp160.1.1 |
| openSUSE Tumbleweed | grafana | 11.6.14+security04-1.1 |