« Volver al listado

CVE-2026-33382

Estado: AnalizadaAlta (7.5)—

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS N/A/L/N/N sin autenticación permite DoS remoto. CWE-400 (límite de recursos) y descripción de agotamiento de memoria confirman denegación de servicio de aplicación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Grafana — Grafana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33382",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33382",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-10T15:59:38.846803Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana OSS",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.6.14"
            },
            {
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.2.8"
            },
            {
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.3.6"
            },
            {
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.4.3"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.0.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-10T16:16:29.130",
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-33382",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@grafana.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."
    }
  ],
  "lastModified": "2026-07-13T20:51:35.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B154BC07-0914-4E25-9D84-FB64205493F7",
              "versionEndExcluding": "11.6.15",
              "versionStartIncluding": "11.6.0"
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "052CFAA8-0386-43DF-869A-643997178E8D",
              "versionEndExcluding": "12.2.9",
              "versionStartIncluding": "12.2.0"
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C77AA4CC-A590-4948-A010-5A1154502E47",
              "versionEndExcluding": "12.3.7",
              "versionStartIncluding": "12.3.0"
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F820291A-C1C6-4DBC-8064-6133F16547C4",
              "versionEndExcluding": "12.4.4",
              "versionStartIncluding": "12.4.0"
            },
            {
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "643002A3-545F-4605-AAAF-EF55C5B14392",
              "versionEndExcluding": "13.0.2",
              "versionStartIncluding": "13.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@grafana.com"
}