CVE-2026-27876
Received Received - Intake
SQL Expression Injection in Grafana Plugin Enables Remote Code Execution

Publication date: 2026-03-27

Last updated on: 2026-04-02

Assigner: Grafana Labs

Description
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-27
Last Modified
2026-04-02
Generated
2026-05-07
AI Q&A
2026-03-27
EPSS Evaluated
2026-05-05
NVD
CVE-2026-27876
EUVD
EUVD-2026-16634
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
grafana grafana to 11.6.0 (exc)
grafana grafana From 11.6.14 (inc) to 12.0.0 (exc)
grafana grafana From 12.1.10 (inc) to 12.2.0 (exc)
grafana grafana From 12.2.8 (inc) to 12.3.0 (exc)
grafana grafana From 12.3.6 (inc) to 12.4.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves a chained attack using SQL Expressions combined with a Grafana Enterprise plugin, which can lead to remote arbitrary code execution (RCE). It exploits a feature in Grafana (OSS) called sqlExpressions. Only instances where this feature toggle is enabled are vulnerable.


How can this vulnerability impact me? :

The vulnerability can allow an attacker to execute arbitrary code remotely on the affected system. This can lead to complete compromise of the system, including unauthorized access, data theft, data manipulation, or disruption of services.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, it is recommended to update Grafana to the latest version to avoid future attack vectors.

Additionally, ensure that the sqlExpressions feature toggle is disabled if it is not required, as only instances with this feature enabled are vulnerable.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart