CVE-2026-33376 - Vulnerability Details - OpenCVE

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Grafana	Grafana

No data.

No data.

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2026-33376

History

Thu, 14 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-285

Thu, 14 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Grafana Grafana grafana
Vendors & Products		Grafana Grafana grafana

Thu, 14 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1188
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 13 May 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-285

Wed, 13 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
Title		Auth Proxy IPv6 whitelist bypass
References		https://grafana.com/security/security-advisories/cve-2026-33376
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2026-05-13T19:28:34.473Z

Updated: 2026-05-14T12:37:51.925Z

Reserved: 2026-03-19T07:55:06.977Z

Link: CVE-2026-33376

Vulnrichment

Updated: 2026-05-14T12:37:45.503Z

NVD

Status : Awaiting Analysis

Published: 2026-05-13T20:16:20.367

Modified: 2026-05-14T16:21:02.930

Link: CVE-2026-33376

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33376", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-03-19T07:55:06.977Z", "datePublished": "2026-05-13T19:28:34.473Z", "dateUpdated": "2026-05-14T12:37:51.925Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["OnPrem"], "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.14", "status": "affected", "version": "9.4.0", "versionType": "semver"}, {"lessThan": "11.6.14+security-04", "status": "affected", "version": "11.6.14", "versionType": "custom"}, {"lessThanOrEqual": "12.2.8", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "12.2.8+security-04", "status": "affected", "version": "12.2.8", "versionType": "custom"}, {"lessThanOrEqual": "12.3.6", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.3.6+security-04", "status": "affected", "version": "12.3.6", "versionType": "custom"}, {"lessThanOrEqual": "12.4.3", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "12.4.3+security-02", "status": "affected", "version": "12.4.3", "versionType": "custom"}, {"lessThanOrEqual": "13.0.1", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.0.1+security-01", "status": "affected", "version": "13.0.1", "versionType": "custom"}]}], "datePublic": "2026-05-13T07:44:00.000Z", "descriptions": [{"lang": "en", "value": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here."}], "metrics": [{"cvssV3_1": {"baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-05-13T19:35:08.211Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-33376"}], "source": {"discovery": "BUG_BOUNTY"}, "title": "Auth Proxy IPv6 whitelist bypass"}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1188", "lang": "en", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T12:37:33.912176Z", "id": "CVE-2026-33376", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T12:37:51.925Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Auth Proxy IPv6 whitelist bypass", "source": {"discovery": "BUG_BOUNTY"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "11.6.14", "lessThan": "11.6.14+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.2.8", "lessThan": "12.2.8+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.3.6", "lessThan": "12.3.6+security-04", "versionType": "custom"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "12.4.3", "lessThan": "12.4.3+security-02", "versionType": "custom"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}, {"status": "affected", "version": "13.0.1", "lessThan": "13.0.1+security-01", "versionType": "custom"}], "platforms": ["OnPrem"], "defaultStatus": "unaffected"}], "datePublic": "2026-05-13T07:44:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-33376", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-05-13T19:35:08.211Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33376", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T12:37:33.912176Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-14T12:37:45.503Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-33376", "state": "PUBLISHED", "dateUpdated": "2026-05-13T19:35:08.211Z", "dateReserved": "2026-03-19T07:55:06.977Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-05-13T19:28:34.473Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}