CVE catalog
CVE-2026-33376
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128)
- Severity
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.28% · Oct 25, 2026
A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation. grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default A flaw in Grafana's Auth Proxy IPv6 allow-list defaults to an overly broad /32 mask, potentially allowing unauthorized access. This strictly affects Auth Proxy deployments using IPv6 allow-lists; other authentication methods are unaffected. This has been rated moderate since auth proxy authentication is not enabled by default on grafana shipped on RHEL. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | grafana | Not reported | 11.6.14 | fixed |
| Cpe | grafana | Not reported | 12.2.8 | fixed |
| Cpe | grafana | Not reported | 12.3.6 | fixed |
| Cpe | grafana | Not reported | 12.4.3 | fixed |
| Cpe | grafana | Not reported | Not reported | unknown |
| Ubuntu | grafana | 16.04 | 2.6.0+dfsg-1 | vulnerable |
| Cpe | grafana | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | grafana | cpe | Not reported | 11.6.14 | Not reported | Not reported | Not reported |
| Cpe | grafana | cpe | Not reported | 12.2.8 | Not reported | Not reported | Not reported |
| Cpe | grafana | cpe | Not reported | 12.3.6 | Not reported | Not reported | Not reported |
| Cpe | grafana | cpe | Not reported | 12.4.3 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2768-1.json]
- [https://grafana.com/security/security-advisories/cve-2026-33376]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-33376]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-33376]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33376.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1546.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]