---
id: CVE-2024-9264
title: Grafana SQL Expressions allow for remote code execution
summary: >-
  The SQL Expressions experimental feature of Grafana allows for the evaluation
  of `duckdb` queries containing user input. These queries are insufficiently
  sanitized before being passed to `duckdb`, leading to a command injection and
  local…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: Grafana
product: Grafana
affected:
  - Grafana >= 11.0.0 < 11.0.5
  - Grafana >= 11.1.0 < 11.1.6
  - Grafana >= 11.2.0 < 11.2.1
  - Grafana >= 11.0.0 < 11.0.6
  - Grafana >= 11.1.0 < 11.1.7
  - Grafana >= 11.2.0 < 11.2.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-11-01T03:55:22.563345Z'
exploitAvailable: true
published: '2024-10-18'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:11:17.366Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-9264'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2024-9264/'
tags:
  - cve.org
  - exploit-available
epss: 0.97553
epssPercentile: 0.99902
exploits:
  github: 14
  githubRepos:
    - 'https://github.com/nollium/CVE-2024-9264'
    - 'https://github.com/z3k0sec/File-Read-CVE-2024-9264'
    - 'https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit'
  metasploit:
    - exploit/multi/http/grafana_sql_expressions_rce_cve_2024_9264
  nuclei:
    - CVE-2024-9264
  checkedAt: '2026-11-05T20:33:42.475Z'
ingestedAt: '2026-11-05T20:33:06.645Z'
---

## Overview

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

## Affected

- `Grafana >= 11.0.0 < 11.0.5`
- `Grafana >= 11.1.0 < 11.1.6`
- `Grafana >= 11.2.0 < 11.2.1`
- `Grafana >= 11.0.0 < 11.0.6`
- `Grafana >= 11.1.0 < 11.1.7`
- `Grafana >= 11.2.0 < 11.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.