CVE-2026-33379: 
Grafana vulnerability analysis and mitigation

CVE-2026-33379 is a missing authorization vulnerability in Grafana OSS and Grafana Enterprise that allows any authenticated user — regardless of role — to create, externally publish, and delete dashboard snapshots. Only Grafana OSS and Grafana Enterprise versions 12.4.0 through 12.4.3 are affected; earlier versions and Grafana 13 are not vulnerable. The vulnerability was published on November 6, 2026, with a patch available in version 12.4.4. It carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory, Grafana Advisory).

The root cause is CWE-862 (Missing Authorization): the snapshot management endpoints in Grafana 12.4 fail to enforce role-based access controls, allowing any authenticated principal — including Viewer-role users and service accounts with no assigned permissions — to invoke snapshot creation, external publication, and deletion operations. The attack vector is network-based, requires low privileges (any valid authentication token), no user interaction, and has a changed scope because the externally published snapshots can be accessed outside the Grafana instance boundary. No public proof-of-concept or technical write-up detailing specific API endpoints or payloads has been published as of the disclosure date (GitHub Advisory, Grafana Advisory).

Successful exploitation allows low-privileged or Viewer-role users to publish dashboard snapshots externally, potentially exposing sensitive monitoring data, metrics, and infrastructure details to unauthorized parties (high confidentiality impact). Attackers can also delete snapshots created by other users, causing minor data integrity loss. Availability is not directly impacted, but the cross-scope nature of external snapshot publication means data can leak beyond the Grafana instance to external snapshot hosting services (GitHub Advisory, Grafana Advisory).

As of the disclosure date (November 6, 2026), there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0021 (0.21%), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Advisory).

1. Authentication: Obtain any valid Grafana account credential or service account token for a Grafana OSS or Enterprise 12.4.0–12.4.3 instance — even a Viewer-role account suffices.
2. Identify target instance: Confirm the Grafana version is within the affected range (12.4.0–12.4.3) via the Grafana login page, API endpoint /api/health, or version disclosure in HTTP headers.
3. Create a dashboard snapshot: Send an authenticated HTTP POST request to the Grafana snapshot API (e.g., /api/snapshots) with a dashboard JSON payload, bypassing the authorization check that should restrict this action to higher-privileged roles.
4. Externally publish the snapshot: Include the external: true parameter in the snapshot creation request to publish the snapshot to an external snapshot service (e.g., snapshots.raintank.io), making dashboard data accessible without authentication to anyone with the snapshot URL.
5. Delete snapshots: Send authenticated DELETE requests to /api/snapshots/{key} or /api/snapshots-delete/{deleteKey} to remove snapshots created by other users, leveraging the same missing authorization check (GitHub Advisory, Grafana Advisory).

• Network: Unexpected HTTP POST requests to /api/snapshots with "external": true from low-privileged user accounts or service accounts; outbound connections from the Grafana server to external snapshot hosting services (e.g., snapshots.raintank.io) initiated by non-admin accounts.
• Logs: Grafana access logs showing snapshot creation or deletion API calls (POST /api/snapshots, DELETE /api/snapshots/*) attributed to Viewer-role users or service accounts that should not have this capability; unusual volume of snapshot operations in a short time window.
• Application: Unexpected increase in the number of externally published snapshots visible in the Grafana snapshot management UI; snapshots containing sensitive dashboard data appearing on external snapshot hosting URLs.

Upgrade Grafana OSS and Grafana Enterprise to version 12.4.4 or later, which contains the authorization fix. Organizations unable to patch immediately should restrict network access to Grafana snapshot API endpoints, disable external snapshot publishing via Grafana configuration (snapshots.external_enabled = false in grafana.ini), and audit existing snapshots for unauthorized external publications. Monitor snapshot creation and deletion activity for anomalous behavior from low-privileged accounts (Grafana Advisory, GitHub Advisory).

The vulnerability received brief coverage on Mastodon via TheHackerWire shortly after disclosure. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT published alerts referencing the CVE. No significant vendor statements beyond the Grafana security advisory, nor notable independent researcher commentary, have been observed as of the disclosure date (GitHub Advisory).