CVE-2026-33376: Vulnerability in Grafana Grafana OSS
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
AI Analysis
Technical Summary
The vulnerability in Grafana OSS's Auth Proxy feature involves the default application of a /32 mask to IPv6 allow-list entries. This can lead to unintended broader access than intended if the user does not explicitly specify a more restrictive mask (usually /128). The flaw is limited to the Auth Proxy authentication method and does not affect other authentication integrations. No official remediation or patch is currently documented, and no known exploits are reported in the wild.
Potential Impact
This vulnerability can result in unauthorized access through the Auth Proxy feature by allowing a broader range of IPv6 addresses than intended. The impact is high due to the potential for unauthorized access (confidentiality and integrity impact) without requiring user interaction or privileges. Other authentication methods remain unaffected.
Mitigation Recommendations
To mitigate this vulnerability, users should explicitly specify the desired IPv6 mask (typically /128) in the allow-list entries for the Auth Proxy feature. Since no official patch or fix is currently documented, this configuration change is the recommended immediate mitigation. Monitor vendor advisories for any future official fixes.
CVE-2026-33376: Vulnerability in Grafana Grafana OSS
Description
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
CVSS v3.1
Score 7.4high
Affected software
Grafana
Grafana OSS
pkg:github/grafana/grafanaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Grafana OSS's Auth Proxy feature involves the default application of a /32 mask to IPv6 allow-list entries. This can lead to unintended broader access than intended if the user does not explicitly specify a more restrictive mask (usually /128). The flaw is limited to the Auth Proxy authentication method and does not affect other authentication integrations. No official remediation or patch is currently documented, and no known exploits are reported in the wild.
Potential Impact
This vulnerability can result in unauthorized access through the Auth Proxy feature by allowing a broader range of IPv6 addresses than intended. The impact is high due to the potential for unauthorized access (confidentiality and integrity impact) without requiring user interaction or privileges. Other authentication methods remain unaffected.
Mitigation Recommendations
To mitigate this vulnerability, users should explicitly specify the desired IPv6 mask (typically /128) in the allow-list entries for the Auth Proxy feature. Since no official patch or fix is currently documented, this configuration change is the recommended immediate mitigation. Monitor vendor advisories for any future official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GRAFANA
- Date Reserved
- 2026-03-19T07:55:06.977Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a04d641cbff5d861003f1b8
Added to database: 05/13/2026, 19:51:29 UTC
Last enriched: 08/11/2026, 13:39:01 UTC
Last updated: 09/14/2026, 22:01:33 UTC
Views: 135
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.