CVE-2026-33376 is a vulnerability in Grafana's Auth Proxy IPv6 allow-list used within Red Hat's Multicluster Global Hub 1.4.8. The flaw is due to an incorrect default subnet mask of /32 instead of the stricter /128 for IPv6 addresses. This misconfiguration can allow remote attackers to bypass access restrictions, leading to unauthorized access and potential data manipulation. The issue strictly affects deployments using Auth Proxy with IPv6 allow-lists; other authentication methods are unaffected. Red Hat rates this vulnerability as critical and provides mitigation guidance to explicitly set the IPv6 mask in the configuration file (/etc/grafana/grafana.ini) under the [auth.proxy] section, followed by a service restart. No official patch version is indicated, so remediation relies on configuration changes.

The vulnerability allows unauthorized remote attackers to bypass IPv6-based access restrictions in Grafana's Auth Proxy, potentially leading to unauthorized access and data manipulation within the Multicluster Global Hub environment. Since the default mask is overly permissive, attackers from unintended IPv6 addresses could gain access. The impact is critical due to the potential for unauthorized access and high confidentiality and integrity impact. However, this affects only Auth Proxy deployments using IPv6 allow-lists, which are not enabled by default in Grafana shipped on RHEL.

Red Hat advises explicitly specifying the intended IPv6 address mask (typically /128 for a single host) in the Grafana Auth Proxy allow-list configuration to override the incorrect default /32 mask. This is done by updating the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini (e.g., ::1/128). After making this configuration change, restart the Grafana service using 'systemctl restart grafana-server' for the changes to take effect. No official patch or update version is currently provided, so applying this configuration change is the recommended mitigation.