CVE-2026-27876: Vulnerability in Grafana Grafana Enterprise
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-27876) in Grafana Enterprise arises from a chained attack vector involving SQL Expressions and a plugin, enabling remote code execution. It specifically affects versions with the sqlExpressions feature enabled within the version ranges 11.6.0 to before 11.6.14, 12.0.0 to before 12.1.10, 12.2.0 to before 12.2.8, 12.3.0 to before 12.3.6, and 12.4.0 to before 12.4.2. The vulnerability is addressed in versions 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2, and all versions 13.0.0 and later. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code).
Potential Impact
Successful exploitation of this vulnerability can lead to remote arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected system. This can allow attackers with high privileges to execute code remotely without user interaction. The vulnerability affects only instances with the sqlExpressions feature enabled and specific vulnerable versions. There are no known exploits in the wild at the time of publication.
Mitigation Recommendations
A fix is available in Grafana Enterprise versions 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2, and all versions 13.0.0 and above. Users should update affected instances to these fixed versions to remediate the vulnerability. Instances with the sqlExpressions feature toggle disabled are not vulnerable. Since this is not a cloud service, remediation depends on user patching. Patch status is confirmed by the vendor advisory embedded in the version information.
CVE-2026-27876: Vulnerability in Grafana Grafana Enterprise
Description
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-27876) in Grafana Enterprise arises from a chained attack vector involving SQL Expressions and a plugin, enabling remote code execution. It specifically affects versions with the sqlExpressions feature enabled within the version ranges 11.6.0 to before 11.6.14, 12.0.0 to before 12.1.10, 12.2.0 to before 12.2.8, 12.3.0 to before 12.3.6, and 12.4.0 to before 12.4.2. The vulnerability is addressed in versions 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2, and all versions 13.0.0 and later. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code).
Potential Impact
Successful exploitation of this vulnerability can lead to remote arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected system. This can allow attackers with high privileges to execute code remotely without user interaction. The vulnerability affects only instances with the sqlExpressions feature enabled and specific vulnerable versions. There are no known exploits in the wild at the time of publication.
Mitigation Recommendations
A fix is available in Grafana Enterprise versions 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2, and all versions 13.0.0 and above. Users should update affected instances to these fixed versions to remediate the vulnerability. Instances with the sqlExpressions feature toggle disabled are not vulnerable. Since this is not a cloud service, remediation depends on user patching. Patch status is confirmed by the vendor advisory embedded in the version information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GRAFANA
- Date Reserved
- 2026-02-24T14:30:17.726Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69c697e13c064ed76fb72296
Added to database: 3/27/2026, 2:44:49 PM
Last enriched: 4/4/2026, 6:37:33 AM
Last updated: 5/12/2026, 10:37:35 AM
Views: 757
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.