CVE-2026-33375: Grafana MSSQL Plugin DoS Vulnerability

CVE-2026-33375 Overview

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. This vulnerability represents a significant denial of service risk for organizations running Grafana with MSSQL data source configurations.

Critical Impact

Low-privileged Viewer users can crash Grafana containers through memory exhaustion, causing service disruption without requiring elevated permissions.

Affected Products

• Grafana MSSQL Data Source Plugin (specific versions not disclosed)
• Grafana installations utilizing MSSQL data source connections
• Containerized Grafana deployments

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33375 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33375

Vulnerability Analysis

This vulnerability exists in the Grafana MSSQL data source plugin's handling of API requests. The flaw allows users with Viewer-level permissions—typically the lowest privilege tier in Grafana's role-based access control model—to bypass restrictions that should prevent them from executing resource-intensive operations. When exploited, the vulnerability causes uncontrolled memory allocation leading to an Out-Of-Memory condition that crashes the host container.

The attack can be executed over the network without user interaction, making it practical for both malicious insiders and attackers who have compromised low-privilege accounts. Since only availability is impacted (no data confidentiality or integrity breach), this aligns with a denial of service classification.

Root Cause

The root cause is a logic flaw in the authorization checks within the MSSQL data source plugin. The plugin fails to properly validate that Viewer-level users should be restricted from triggering operations that can consume unbounded system memory. This insufficient access control check allows authenticated low-privilege users to invoke functionality that should be reserved for higher-privileged roles such as Editors or Admins.

Attack Vector

The attack vector is network-based and requires only low-level authentication (Viewer role). An attacker with valid Viewer credentials can send specially crafted requests to the MSSQL data source plugin API. These requests exploit the logic flaw to trigger memory allocation operations that are not properly bounded or rate-limited. As the memory consumption grows unchecked, the Grafana container eventually exhausts available memory and crashes.

The vulnerability mechanism involves bypassing API restrictions that normally prevent Viewers from executing certain query patterns or operations. For technical implementation details, refer to the Grafana Security Advisory.

Detection Methods for CVE-2026-33375

Indicators of Compromise

• Sudden memory spikes in Grafana containers correlated with API requests from Viewer-level accounts
• Unexpected container restarts or OOM killer events in Grafana deployments
• Unusual patterns of MSSQL data source API calls from low-privileged users
• Memory allocation logs showing unbounded growth before container failures

Detection Strategies

• Monitor container memory usage metrics for anomalous spikes exceeding baseline patterns
• Implement logging for all MSSQL data source plugin API calls with user role attribution
• Configure alerts for OOM killer events targeting Grafana processes
• Audit Viewer-level user activity for unexpected API call patterns to data source endpoints

Monitoring Recommendations

• Enable detailed access logging for the MSSQL data source plugin API endpoints
• Set up memory threshold alerts at 70%, 85%, and 95% container memory utilization
• Correlate container crash events with user activity logs to identify potential exploitation
• Monitor for repeated authentication attempts followed by high-memory API operations

How to Mitigate CVE-2026-33375

Immediate Actions Required

• Review and apply patches from Grafana for the MSSQL data source plugin
• Audit Viewer-level user accounts for unnecessary data source access permissions
• Implement memory limits on Grafana containers to contain blast radius of OOM conditions
• Consider temporarily restricting MSSQL data source access to trusted users until patched

Patch Information

Grafana has published a security advisory addressing this vulnerability. Organizations should consult the Grafana Security Advisory for specific patch versions and upgrade instructions. Apply the recommended updates to all Grafana instances utilizing the MSSQL data source plugin.

Workarounds

• Restrict MSSQL data source access to Editor and Admin roles only, removing Viewer access temporarily
• Implement container resource limits to prevent a single OOM event from affecting other services
• Deploy API rate limiting at the network or application level for data source endpoints
• Consider network segmentation to limit exposure of Grafana instances to trusted networks only

# Example: Set container memory limits for Grafana (Docker)
docker run -d \
  --name grafana \
  --memory="2g" \
  --memory-swap="2g" \
  -p 3000:3000 \
  grafana/grafana:latest