CVE-2026-33376 Auth Proxy IPv6 whitelist bypass
Attackers can bypass IPv6 allow-list restrictions in Grafana's Auth Proxy feature due to incorrect default subnet masking, requiring manual configuration updates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33376?
CVE-2026-33376 is a high-severity authentication bypass vulnerability in Grafana Grafana, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
Weakness: CWE-1188
Which versions are affected by CVE-2026-33376?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 9.4.0 | 11.6.14, 12.2.8, 12.3.6, 12.4.3, 13.0.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-33376?
Upgrade grafana to a fixed version for your release line: 11.6.14, 12.2.8, 12.3.6 or 12.4.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-33376 being exploited?
There is no known exploitation of CVE-2026-33376 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-33376, GHSA-3r2p-7499-27q3, MINI-28m3-5v2q-6qrw, MINI-3r52-84rf-gfm8, MINI-4jj3-5q44-59m8, MINI-6w92-m35j-w97p and 13 more.