CVE-2026-33376
- Source
- https://cve.org/CVERecord?id=CVE-2026-33376
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33376.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-33376
- Aliases
- Downstream
CGA (42)
- CGA-2c39-p5jq-c68q
- CGA-2v6w-xf8x-2mgr
- CGA-2v89-2h9j-87f3
- CGA-3758-2rf5-h72p
- CGA-3fgf-c4x6-w34j
- CGA-3hvq-gq86-5mhr
- CGA-3wv8-64h3-27hr
- CGA-4ch8-cc8q-vcgv
- CGA-4mmr-36hf-px2m
- CGA-4r2h-9ppm-6vxg
- CGA-5g4q-42rf-m8q5
- CGA-5m7r-9wc4-pmfq
- CGA-64mw-484h-8hx6
- CGA-6wmv-5p75-4xp7
- CGA-7c3q-h4pj-hrj5
- CGA-7rp7-46rj-jf28
- CGA-8382-vg4w-fg5w
- CGA-85hr-r7j9-6v89
- CGA-8rvf-wjx9-rmg5
- CGA-8wvq-4f2q-f5v4
- CGA-9vch-5v2c-9v3j
- CGA-ch9g-x7ch-gp9p
- CGA-j582-5m9c-84hh
- CGA-jrgq-qqvj-wfx8
- CGA-jvxw-87r4-hcj9
- CGA-jxmg-rx2v-m3mr
- CGA-m3mq-qgpq-89rr
- CGA-m5pm-wgc8-3mf9
- CGA-m7vh-99rq-c2f4
- CGA-p3q8-x8fw-33gq
- CGA-p4j8-jxc9-hpxp
- CGA-q3rr-w94x-94mf
- CGA-qgxc-939m-4r3g
- CGA-rwgf-vg65-2hvv
- CGA-v4wg-6mf3-7pvv
- CGA-w2pp-9595-6cjj
- CGA-w43w-wv37-qc7r
- CGA-w69m-fxjv-hhgp
- CGA-wcc3-2jpg-j3cc
- CGA-wrwc-f3fg-cjxf
- CGA-xvg8-247h-p5gj
- CGA-xvmw-6r29-p68f
MINI (16)
- MINI-28m3-5v2q-6qrw
- MINI-3r52-84rf-gfm8
- MINI-4jj3-5q44-59m8
- MINI-6w92-m35j-w97p
- MINI-8g72-c866-6qhr
- MINI-8x8q-xprw-mr72
- MINI-966j-w9w6-4m2x
- MINI-gcjx-875q-gpmf
- MINI-h27q-q64w-mmwg
- MINI-jmcx-hhxc-h8rx
- MINI-jv8x-xqf2-f984
- MINI-jxr2-66jf-xr33
- MINI-pc3q-gfxc-pwcv
- MINI-v47x-9gwx-6p27
- MINI-vgqj-56p7-8wxr
- MINI-xvpc-mm96-cpgf
openSUSE (2)
RHSA (9)
RLSA (2)
UBUNTU (1)
- Related
- Published
- 2026-05-13T19:28:34Z
- Modified
- 2026-10-28T02:30:21Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Auth Proxy IPv6 whitelist bypass
- Details
-
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
- Database specific
{ "cna_assigner": "GRAFANA", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33376.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "9.4.0" }, { "last_affected": "11.6.14" }, { "introduced": "11.6.14" }, { "fixed": "11.6.14+security-04" }, { "introduced": "12.0.0" }, { "last_affected": "12.2.8" }, { "introduced": "12.2.8" }, { "fixed": "12.2.8+security-04" }, { "introduced": "12.3.0" }, { "last_affected": "12.3.6" }, { "introduced": "12.3.6" }, { "fixed": "12.3.6+security-04" }, { "introduced": "12.4.0" }, { "last_affected": "12.4.3" }, { "introduced": "12.4.3" }, { "fixed": "12.4.3+security-02" }, { "introduced": "13.0.0" }, { "last_affected": "13.0.1" }, { "introduced": "13.0.1" }, { "fixed": "13.0.1+security-01" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
Affected packages
Git / github.com/grafana/grafana
Affected ranges
- Type
- GIT
- Repo
- https://github.com/grafana/grafana
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.5.0" }, { "fixed": "11.6.14" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.2.0" }, { "fixed": "12.2.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.3.0" }, { "fixed": "12.3.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.4.0" }, { "fixed": "12.4.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*", "range": [ { "introduced": "11.6.14-NA" }, { "last_affected": "11.6.14-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*", "range": [ { "introduced": "11.6.14-security01" }, { "last_affected": "11.6.14-security01" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*", "range": [ { "introduced": "12.2.8-NA" }, { "last_affected": "12.2.8-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*", "range": [ { "introduced": "12.2.8-security01" }, { "last_affected": "12.2.8-security01" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*", "range": [ { "introduced": "12.3.6-NA" }, { "last_affected": "12.3.6-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*", "range": [ { "introduced": "12.3.6-security01" }, { "last_affected": "12.3.6-security01" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*", "range": [ { "introduced": "12.4.3-NA" }, { "last_affected": "12.4.3-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*", "range": [ { "introduced": "13.0.0" }, { "last_affected": "13.0.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*", "range": [ { "introduced": "13.0.1-NA" }, { "last_affected": "13.0.1-NA" } ], "source": "CPE_STRING" } ] }