[ CVE-2026-33374 · Published 13 Oct 2026 ]

Vulnerability in Grafana Enterprise

CVSS 6.5 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund13 Oct 2026WID-SEC-2026-3910

Grafana: Multiple vulnerabilities Translated from German
CVE-2026-33374CVE-2026-95502CVE-2026-93294+1 more CVEs

[ References ]References

grafana.com/security/security-advisories/cve-2026-33374

[ Facts ]Key facts

CVE: CVE-2026-33374
EUVD: EUVD-2026-98905
Published: 13 Oct 2026, 18:17 UTC
Updated: 16 Oct 2026, 20:02 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Scored by security@grafana.com
EPSS: 0.37% chance of exploitation in 30 days · higher than 29% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-400 CWE-770 CWE-789

[ Affected ]Affected products

Grafana Grafana Enterprise12.0.0 – ≤ 12.3.11, 12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4
Grafana Grafana OSS12.0.0 – ≤ 12.3.11, 12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Grafana: Multiple vulnerabilities Translated from German

[ References ]References