CVE-2026-27876: RCE on Grafana via sqlExpressions
CVE-2026-27876 is a critical code injection issue (CWE-94) in Grafana that the vendor describes as a chain involving SQL Expressions and a Grafana Enterprise plugin, which can lead to remote code execution. Only instances with the sqlExpressions feature toggle enabled are affected, in specific version ranges with fixes listed in the record. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-27876 is a critical remote code execution issue in Grafana, classified as CWE-94 (Code Injection). According to the vendor description, a chained attack using SQL Expressions and a Grafana Enterprise plugin can lead to arbitrary code execution. The vendor advisory is available at Grafana security advisory.
Impact
- The record assigns a CVSS base score of 9.1 (critical), with high confidentiality, integrity and availability impact and a changed scope according to its vector.
- The SSVC data in the record rates technical impact as total.
- Successful exploitation would allow arbitrary code execution on the affected server. The practical consequences depend on the deployment and are not detailed in the sources.
Affected products and versions
The sources list Grafana as affected only in the following ranges, and only when the sqlExpressions feature toggle is enabled:
- From 11.6.0 up to 11.6.14 (fixed in 11.6.14). 11.5 and earlier are not affected.
- From 12.0.0 up to 12.1.10 (fixed in 12.1.10). 12.0 did not receive an update because it is end-of-life.
- From 12.2.0 up to 12.2.8 (fixed in 12.2.8).
- From 12.3.0 up to 12.3.6 (fixed in 12.3.6).
- From 12.4.0 up to 12.4.2 (fixed in 12.4.2). 13.0.0 and above include the fix, and the record states that no release in that line is affected.
The structured fixes field in the record is empty, so the fixed versions above are taken from the description text.
Exploitation status
The record shows no CISA KEV listing. The SSVC exploitation value is none and automatable is no. The EPSS probability is 0.01384 with a percentile of 0.7199. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade Grafana to the fixed release for your branch: 11.6.14, 12.1.10, 12.2.8, 12.3.6 or 12.4.2, or move to 13.0.0 or later.
- Where an immediate upgrade is not possible, check whether the sqlExpressions feature toggle is enabled. Disabling it is a reasonable interim step if your workloads allow it, since the description says only instances with this toggle are vulnerable; confirm this approach with the vendor guidance.
- Plan upgrades for end-of-life branches, because 12.0 did not receive a fix.
Detection guidance
- Inventory Grafana versions across your environments and record whether the sqlExpressions feature toggle is enabled.
- Review logs and configuration for unexpected changes to Grafana plugins and for unusual use of SQL Expressions, at a high level. The sources do not describe specific indicators of compromise.
Limitations of the available information
- The record does not name the Enterprise plugin involved and does not describe the full chain of steps.
- The required privileges are indicated only through the CVSS vector, and network exposure conditions are not described in detail.
- No indicators of compromise, exploit timelines or vendor-confirmed exploitation details are present in the record.
Frequently asked questions
Which Grafana instances are affected by CVE-2026-27876?
According to the record, only instances with the sqlExpressions feature toggle enabled are vulnerable, and only within the listed ranges, from 11.6.0 up to 11.6.14, from 12.0.0 up to 12.1.10, from 12.2.0 up to 12.2.8, from 12.3.0 up to 12.3.6, and from 12.4.0 up to 12.4.2.
Which versions contain the fix?
The description lists 11.6.14, 12.1.10, 12.2.8, 12.3.6 and 12.4.2 as fixed releases for their branches, and states that 13.0.0 and above include the fix. The structured fixes field in the record is empty.
Is this vulnerability being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.