GRAFANA · CVE-2026-33379 · Runtime
NO FIX YET
Grafana OSS and Grafana Enterprise 12.4 lack an authorization check on dashboard snapshots. Any signed-in user, including Viewers and service accounts with no permissions, can create, externally publish, and delete snapshots.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted or enterprise Grafana 12.4 with user accounts or service accounts that are not trusted to publish dashboard data. The sources only name Grafana OSS and Grafana Enterprise 12.4 as affected, so Grafana 13 and earlier versions are out of scope.
Not affected if grafana-13, pre-12.4-version
Who cares authenticated, dashboards, grafana, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.