Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-33380 BIT-grafana-2026-33380EUVD-2026-30145GHSA-gxcp-jjxh-rwp4GO-2026-5409

SQL Expressions Read File From Disk

Published May 13, 2026 · Updated Aug 27, 2026 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana OSS Package: github.com/grafana/grafana Package: grafana Package: grafana-12.4 Category: Web / CMS Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Affected products

VendorProductAffectedFixed
Grafana Grafana OSS 11.6.0 – ≤ 11.6.14, 11.6.14 – < 11.6.14+security-04, 12.0.0 – ≤ 12.2.8, 12.2.8 – < 12.2.8+security-04, 12.3.0 – ≤ 12.3.6, 12.3.6 – < 12.3.6+security-04, 12.4.0 – ≤ 12.4.3, 12.4.3 – < 12.4.3+security-02, 13.0.0 – ≤ 13.0.1, 13.0.1 – < 13.0.1+security-01 11.6.14+security-04

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.10-0.6.hum1 RHSA-2026:68821
Red Hat Hardened Images 1 grafana13.1 13.1.6-0.1.hum1 RHSA-2026:68767
Red Hat Hardened Images 1 grafana13.2 13.2.1-0.5.hum1 RHSA-2026:68778

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 grafana 12.4.5-150200.3.91.1 SUSE-SU-2026:3718-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Multi Linux Manager Tools SLE-Micro-5 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-QubitProducts-exporter_exporter 0.4.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-boynux-squid_exporter 1.13.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-lusitaniae-apache_exporter 1.0.10-150002.3.9.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-alertmanager 0.28.1-150002.4.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-prometheus 3.5.3-150002.3.13.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.6.14+security04-150002.4.21.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.2.4-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-blackbox_exporter 0.26.0-150002.3.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-postgres_exporter 0.10.1-150002.3.3.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 python-defusedxml-sle15 0.7.1-150002.1.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 rhnlib 5.2.5-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.2.8-150002.3.12.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.2.6-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-salt 1.2.3-150002.3.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-susemanager-client 5.2.3-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-common-libs 5.2.5-150002.3.6.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-attestation-image +3 5.1.4-8.22.10 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image +3 5.1.4-8.20.12 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-image +3 5.1.4-8.20.34 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image +3 5.1.4-8.20.13 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-postgresql-image +3 5.1.4-6.24.3 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-saline-image +3 5.1.4-9.20.24 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 uyuni-tools 5.1.29-150700.3.26.1 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-httpd-image +3 5.1.4-8.22.22 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image +3 5.1.4-9.20.25 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-squid-image +3 5.1.4-8.20.11 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-ssh-image +3 5.1.4-8.20.12 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image +3 5.1.4-8.20.13 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 uyuni-tools 5.1.29-150700.3.26.1 SUSE-SU-2026:2774-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 11.6.14+security04-1.1 openSUSE-SU-2026:10932-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 grafana 11.6.14+security04-bp160.1.1 openSUSE-SU-2026:20940-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling grafana-12.4 12.4.3.02-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana < 1.9.2-0.20260513165311-fb7336fc36c1 1.9.2-0.20260513165311-fb7336fc36c1 GHSA-gxcp-jjxh-rwp4
Go github.com/grafana/grafana all versions — GO-2026-5409

Advisories 10

References