What is CVE-2026-33376?

CVE-2026-33376 is a security advisory published by Grafana Labs Security. Auth Proxy IPv6 whitelist bypass

Why does CVE-2026-33376 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

CVE-2026-33376Disclosed before NVD

Auth Proxy IPv6 whitelist bypass

Vendor

Grafana Labs Security

Published

May 13, 2026

Last Modified

—

📋 Description

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here. This vulnerability was reported via our bug bounty program.

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-33376/