Cyber Posture

CVE-2026-33376

High

Published: 13 May 2026

Published
13 May 2026
Modified
14 May 2026
KEV Added
Patch
CVSS Score 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0003 9.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33376 is a high-severity Initialization of a Resource with an Insecure Default (CWE-1188) vulnerability in Grafana (inferred from references). Its CVSS base score is 7.4 (High).

Operationally, ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1188

Requires documented secure initialization practices and avoidance of insecure defaults in configuration baselines.

addresses: CWE-1188

Reviewing and updating baseline when components are installed or upgraded prevents initialization with insecure defaults.

addresses: CWE-1188

Requiring explicit configuration to minimal functionality overrides insecure defaults that would otherwise enable excess capabilities.

addresses: CWE-1188

Tailoring replaces or augments insecure default initializations with system-specific values and compensating controls before deployment.

addresses: CWE-1188

Central configuration overrides or replaces insecure default initializations that would otherwise be left unchanged on each system.

addresses: CWE-1188

SCRM practices during acquisition and configuration management address insecure default initializations shipped by vendors.

addresses: CWE-1188

Scans detect resources initialized with insecure defaults that create exploitable conditions.

addresses: CWE-1188

Instruction on secure initialization of security controls prevents leaving resources with insecure defaults after installation.

NVD Description

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected;…

more

Okta, SAML, LDAP, etc are unaffected here.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)

Affected Products

Grafana
inferred from references and description; NVD did not file a CPE for this CVE

References