cbcvebase.
CVE-2026-33376
published 2026-05-13

CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate…

PriorityP344high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.27%
18.6th percentile
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

Affected

20 ranges
VendorProductVersion rangeFixed in
grafanagrafana——
grafanagrafana——
grafanagrafana——
grafanagrafana——
grafanagrafana——
grafanagrafana——
grafanagrafana>= 12.2.0 < 12.2.812.2.8
grafanagrafana>= 12.3.0 < 12.3.612.3.6
grafanagrafana>= 12.4.0 < 12.4.312.4.3
grafanagrafana>= 8.5.0 < 11.6.1411.6.14
grafanagrafana_oss>= 11.6.14 < 11.6.14+security-0411.6.14+security-04
grafanagrafana_oss12.0.0 – 12.2.8—
grafanagrafana_oss>= 12.2.8 < 12.2.8+security-0412.2.8+security-04
grafanagrafana_oss12.3.0 – 12.3.6—
grafanagrafana_oss>= 12.3.6 < 12.3.6+security-0412.3.6+security-04
grafanagrafana_oss12.4.0 – 12.4.3—
grafanagrafana_oss>= 12.4.3 < 12.4.3+security-0212.4.3+security-02
grafanagrafana_oss13.0.0 – 13.0.1—
grafanagrafana_oss>= 13.0.1 < 13.0.1+security-0113.0.1+security-01
grafanagrafana_oss9.4.0 – 11.6.14—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.