CVE-2024-9264Critical· 9.9▾ AbyssalPoC availableThe SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 54.5 · likelihood 19.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
98%
14 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Grafana >= 11.0.0 < 11.0.5Grafana >= 11.1.0 < 11.1.6Grafana >= 11.2.0 < 11.2.1Grafana >= 11.0.0 < 11.0.6Grafana >= 11.1.0 < 11.1.7Grafana >= 11.2.0 < 11.2.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27876Critical· 9.1A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE)
CVE-2023-0507High· 7.3Grafana is an open-source platform for monitoring and observability
CVE-2022-23498High· 7.1Grafana is an open-source platform for monitoring and observability
CVE-2022-23552High· 7.3Grafana is an open-source platform for monitoring and observability
CVE-2022-36062High· 7.6Grafana is an open-source platform for monitoring and observability
CVE-2026-15815High· 8.8Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives