What is CVE-2026-33380?

CVE-2026-33380 is a security advisory published by Grafana Labs Security. SQL Expressions Read File From Disk

Why does CVE-2026-33380 name no CVE ID?

As we last read it, Grafana Labs Security's advisory lists no CVE ID. A vendor can publish an advisory before a CVE record exists for the flaw, and some advisories never get one. CVE IDs are assigned by CVE Numbering Authorities, not by NVD, and we have not measured when, or whether, a CVE record follows.

Which products are affected by CVE-2026-33380?

CVE-2026-33380 affects 1 product, including: Grafana.

CVE-2026-33380No CVE ID named

SQL Expressions Read File From Disk

Vendor

Grafana Labs Security

Published

May 13, 2026

Last Modified

—

📋 Description

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server’s filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-33380/