p PatchFirst

CVE-2026-33375

CVE-2026-33375 · Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: applications

Affected products and versions

  • grafana

    Versions
    • ≥ 11.6.0, < 11.6.14+security-01: Affected (semver)
    • ≥ 12.1.0, < 12.1.10+security-01: Affected (semver)
    • ≥ 12.2.0, < 12.2.8+security-01: Affected (semver)
    • ≥ 12.3.0, < 12.3.6+security-01: Affected (semver)
    • ≥ 12.4.0, < 12.4.2: Affected (semver)

    Update to 11.6.14+security-01; Update to 12.1.10+security-01; Update to 12.2.8+security-01; Update to 12.3.6+security-01; Update to 12.4.2

Original sources

Check your server →