CVE-2026-33379

Summary

A missing authorization check in Grafana OSS and Enterprise 12.4 allows any authenticated user—including Viewers or service accounts with no permissions—to create, externally publish, and delete dashboard snapshots, potentially exposing sensitive data or disrupting monitoring visibility.

Exploitability

Exploitation requires only valid authentication (any role) and no special conditions; it is trivially exploitable via standard API endpoints.

Blast radius

An attacker could publicly expose internal dashboard snapshots containing sensitive metrics, credentials, or infrastructure details, or delete critical snapshots to erase forensic evidence or disrupt incident response.

Detection

Monitor for API calls to /api/snapshots with POST (create), POST /external (publish), and DELETE methods from users assigned only Viewer roles or service accounts with minimal permissions; look for snapshot creation/deletion events in grafana.log where the user lacks SnapshotCreate, SnapshotExternalSave, or SnapshotDelete permissions.

Prioritized remediation

Upgrade to Grafana OSS or Enterprise 12.4.1 or later, as this version includes the fix for CVE-2026-33379.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.