CVE-2026-33375

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - security@grafana.com

Published

2026-03-26

Last modified

2026-08-27

Weaknesses

CWE-400

Affected products

• Grafana (Grafana)
• Grafana Oss (Grafana)

References

• https://grafana.com/security/security-advisories/cve-2026-33375