Skip to content
OpenAdvisories
Critical · 9.9 Scanner template Public exploit CVE-2024-9264 BIT-grafana-2024-9264EUVD-2024-3110GHSA-q99m-qcv4-fpm7GO-2024-3215

Grafana SQL Expressions allow for remote code execution

Published Oct 18, 2024 · Updated Nov 4, 2026 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana Package: github.com/grafana/grafana Package: grafana Package: grafana Category: Web / CMS Ecosystem: Alpine Ecosystem: Go Ecosystem: Ubuntu

Description

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Affected products

VendorProductAffectedFixed
Grafana Grafana 11.0.0 – < 11.0.5, 11.1.0 – < 11.1.6, 11.2.0 – < 11.2.1, 11.0.0 – < 11.0.6, 11.1.0 – < 11.1.7, 11.2.0 – < 11.2.2 11.0.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 grafana 11.5.5-150200.3.72.2 SUSE-SU-2025:01991-1
SLES 15 SP6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
SLES 15 SP6 grafana 11.5.5-150200.3.72.2 SUSE-SU-2025:01991-1
SLES 15 SP5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
SLES 12 SP5 golang-github-prometheus-node_exporter 1.9.1-1.36.2 SUSE-SU-2025:01987-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 govulncheck-vulndb 0.0.20241104T154416-5.1 openSUSE-SU-2024:0350-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.15.2-150400.3.133.1 SUSE-SU-2025:01985-1
SUSE Manager Proxy Module 4.3 prometheus-blackbox_exporter 0.26.0-150000.1.27.1 SUSE-SU-2025:01989-1
SUSE Manager Client Tools for SLE Micro 5 prometheus-blackbox_exporter 0.26.0-150000.1.27.1 SUSE-SU-2025:01989-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.53.4-150000.3.62.2 SUSE-SU-2025:01989-1
SUSE Manager Client Tools 15 grafana 11.5.5-150000.1.79.1 SUSE-SU-2025:01989-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.26.0-150000.1.27.1 SUSE-SU-2025:01989-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-1.31.2 SUSE-SU-2025:01987-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.9.1-1.36.2 SUSE-SU-2025:01987-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.53.4-1.60.2 SUSE-SU-2025:01987-1
SUSE Manager Client Tools 12 grafana 11.5.5-1.79.2 SUSE-SU-2025:01987-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.26.0-1.27.1 SUSE-SU-2025:01987-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20241030T212825-1.1 openSUSE-SU-2024:14447-1
openSUSE Tumbleweed grafana 11.3.0-1.1 openSUSE-SU-2024:14431-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
openSUSE Leap 15.6 grafana 11.5.5-150200.3.72.2 SUSE-SU-2025:01991-1
openSUSE Leap 15.6 prometheus-blackbox_exporter 0.26.0-150000.1.27.1 SUSE-SU-2025:01989-1
openSUSE Leap 15.5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.20 grafana 11.0.7-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 14 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana >= 11.0.0, < 11.0.6+security-01 11.0.6+security-01 GHSA-q99m-qcv4-fpm7
Go github.com/grafana/grafana >= 11.1.0, < 11.1.7+security-01 11.1.7+security-01 GHSA-q99m-qcv4-fpm7
Go github.com/grafana/grafana >= 11.2.0, < 11.2.2+security-01 11.2.2+security-01 GHSA-q99m-qcv4-fpm7
Go github.com/grafana/grafana all versions — GO-2024-3215

Advisories 10

References