PT-2026-28478 · Grafana · Grafana Mssql Data Source Plugin+1

Tokhanmarshal · Publicado 2026-03-26 · Atualizado 2026-06-10 · CVE-2026-33375

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Grafana MSSQL data source plugin (affected versions not specified)

Description The Grafana MSSQL data source plugin has a logic flaw. A low-privileged user (Viewer) can bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, leading to a crash of the host container. The issue allows a user with limited privileges to cause a denial-of-service condition by exhausting system memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BIT-GRAFANA-2026-33375

CVE-2026-33375

OPENSUSE-SU-2026:10601-1

OPENSUSE-SU-2026:20940-1

Produtos afetados

Grafana

Grafana Mssql Data Source Plugin

Referências · 57

• https://bugzilla.suse.com/1260878 · Nota
• https://suse.com/security/cve/CVE-2026-27876 · Nota
• https://bugzilla.suse.com/1265281 · Nota
• https://bugzilla.suse.com/1263501 · Nota
• https://suse.com/security/cve/CVE-2026-28380 · Nota
• https://suse.com/security/cve/CVE-2026-28374 · Nota
• https://bugzilla.suse.com/1259999 · Nota
• https://suse.com/security/cve/CVE-2026-21721 · Nota
• https://bugzilla.suse.com/1265286 · Nota
• https://suse.com/security/cve/CVE-2026-33376 · Nota
• https://suse.com/security/cve/CVE-2026-41602 · Nota
• https://suse.com/security/cve/CVE-2026-33381 · Nota
• https://bugzilla.suse.com/1260881 · Nota
• https://bugzilla.suse.com/1261025 · Nota
• https://bugzilla.suse.com/1262950 · Nota