Grafana: Schwachstelle ermöglicht Codeausführung

Summary

Product

Vulnerabilities 1

• Critical 9.9
  CVE-2024-9264 Public exploit Scanner template EPSS 98%

  Grafana SQL Expressions allow for remote code execution

  The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulner…

  Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Oct 18, 2024

Revision history

1. 2026-05-03 #4

   Neue Updates von openSUSE aufgenommen

2. 2025-06-17 #3

   Neue Updates von SUSE aufgenommen

3. 2024-10-29 #2

   Neue Updates von openSUSE und PoC aufgenommen

4. 2024-10-17 #1

   Initiale Fassung

References

• Grafana Blog vom 2024-10-17
  https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264/
• Grafana Security Advisory vom 2024-10-17
  https://grafana.com/security/security-advisories/cve-2024-9264/
• openSUSE Security Update OPENSUSE-SU-2024:14431-1 vom 2024-10-29
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RVNCO4DCVAR5DOXQHKMKG3RQOMTUK2C7/
• PoC auf GitHub
  https://github.com/nollium/CVE-2024-9264
• SUSE Security Update SUSE-SU-2025:01991-1 vom 2025-06-18
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021556.html
• openSUSE Security Update OPENSUSE-SU-2026:20654-1 vom 2026-04-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/THD5LB3GL3IHB2BOOMVM5WZLCUMPQWWZ/