Fluid Attacks Database

Description

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel10	grafana	<0:10.2.6-28.el10_2.4	0:10.2.6-28.el10_2.4
rpm rhel9	grafana	<0:10.2.6-23.el9_8.2	0:10.2.6-23.el9_8.2

Aliases

1. CVE-2026-333762. NVD-2026-333763. OSV-2026-33376

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.