Description
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.
Only instances with the sqlExpressions feature toggle enabled are vulnerable.
Only instances in the following version ranges are affected:
- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.
- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.
- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.
- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.
- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana | 11.6.0 – < 11.6.14, 12.0.0 – < 12.1.10, 12.2.0 – < 12.2.8, 12.3.0 – < 12.3.6, 12.4.0 – < 12.4.2 | 11.6.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.1.26-150002.3.12.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.0-150002.3.8.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security01-150002.4.14.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.1.13-150002.3.9.3 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.1.26-150002.3.12.1 | SUSE-SU-2026:1524-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 11.6.14+security01-1.1 | openSUSE-SU-2026:10601-1 |
| openSUSE Leap 16.0 | grafana | 11.6.14+security04-bp160.1.1 | openSUSE-SU-2026:20940-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.3-r0 | — |
| Alpine v3.23 | grafana | 12.2.8-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
ashrafzaryouh/CVE-2026-27876 ★ 3 · Mar 30, 2026
CVE-2026-27876
-
atiilla/CVE-2026-27876 ★ 1 · Sep 5, 2026
Grafana SQL Expressions Arbitrary File Write to RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- WID-SEC-2026-0899 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 23, 2026
- openSUSE-SU-2026:20940-1 Security update for grafana SUSE / openSUSE Security Updates · Jun 13, 2026
- openSUSE-SU-2026:10601-1 grafana-11.6.14+security01-1.1 on GA media SUSE / openSUSE Security Updates · Apr 23, 2026
- SUSE-SU-2026:1524-1 Security update 5.1.3 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Apr 22, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-27876 vendor-advisory