CVE-2026-27876

The attack consists of chaining the SQL Expressions mechanism available in Grafana OSS with functionality provided by the Grafana Enterprise plugin. The vulnerability classified as CWE-94 (code injection) indicates that inadequately controlled user input reaches the code execution engine. A necessary condition is enabling the sqlExpressions feature switch on the vulnerable instance. An attacker with administrative privileges can remotely execute arbitrary code on the server.

Successful exploitation of the vulnerability gives the attacker full control over the server — data reading and modification is possible (C:H, I:H) as well as disruption of service availability (A:H). The scope of the attack extends beyond the vulnerable component (S:C), which increases the risk of further lateral movement in the infrastructure.

Grafana should be updated to a patched version: 11.6.14, 12.1.10, 12.2.8, 12.3.6, or 12.4.2. Versions 13.0.0 and higher are not vulnerable. If immediate update is not possible, the sqlExpressions feature switch should be disabled. The vendor recommends updating to all users regardless of configuration to eliminate potential future attack vectors.

Grafana (OSS and Enterprise) with the sqlExpressions feature switch enabled in the following version ranges: 11.6.0–11.6.13, 12.0.0–12.1.9, 12.2.0–12.2.7, 12.3.0–12.3.5, 12.4.0–12.4.1. Versions 11.5 and older are not vulnerable. Version 12.0 is end-of-life and did not receive a patch.