CVE-2026-27876: Grafana SQL expressions arbitrary file write chained to remote code execution

Critical 9.1 EPSS 2.0% Grafana

Grafana's SQL expressions feature allowed query syntax that writes arbitrary files on the Grafana server. A user who can run data source queries (Viewer or higher) can overwrite a Sqlyze driver or write an AWS data source configuration file and chain this into full remote code execution; Grafana confirmed it could be used to gain an SSH connection to the host. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Grafana rates it CVSS 9.1 (critical).

CVE-2026-27876CVE identifier
9.1CVSS 3.1 base score (critical)
2.0%EPSS: chance of exploitation in the next 30 days (higher than 80% of CVEs)
2026-03-27published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Grafana and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Restart grafana-server (or recreate the container). 12.0.x is end-of-life and received no fix; move to 12.1.10 or later.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.

Affected and fixed versions

Affected:

Grafana 11.6.0 up to (not including) 11.6.14
Grafana 12.0.0 up to (not including) 12.1.10
Grafana 12.2.0 up to (not including) 12.2.8
Grafana 12.3.0 up to (not including) 12.3.6
Grafana 12.4.0 up to (not including) 12.4.2

Fixed in:

Grafana 12.4.2
Grafana 12.3.6
Grafana 12.2.8
Grafana 12.1.10
Grafana 11.6.14
Grafana 13.0.0 and later

Am I affected?

grafana server -v || grafana-server -v
grep -n -A10 '^\[feature_toggles\]' /etc/grafana/grafana.ini | grep -i sqlExpressions
dpkg -l grafana grafana-enterprise 2>/dev/null | grep ^ii; rpm -q grafana grafana-enterprise 2>/dev/null

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

# Grafana APT repository (apt.grafana.com)
sudo apt-get update
sudo apt-get install --only-upgrade grafana   # or grafana-enterprise
sudo systemctl restart grafana-server

Ubuntu

sudo apt-get update
sudo apt-get install --only-upgrade grafana   # or grafana-enterprise
sudo systemctl restart grafana-server

RHEL, AlmaLinux, Rocky, Oracle

# Grafana RPM repository (rpm.grafana.com)
sudo dnf upgrade grafana   # or grafana-enterprise
sudo systemctl restart grafana-server

Fedora

sudo dnf upgrade --refresh grafana

SUSE / openSUSE

sudo zypper refresh
sudo zypper update grafana

Amazon Linux

not in distro repos: rpm.grafana.com grafana

Arch Linux

sudo pacman -Syu

Alpine

apk update && apk upgrade grafana

FreeBSD

pkg update && pkg upgrade grafana

Docker images

docker pull grafana/grafana:12.4.2          # OSS
docker pull grafana/grafana-enterprise:12.4.2   # Enterprise
# older lines: 12.3.6, 12.2.8, 12.1.10, 11.6.14
# update the tag in compose/Helm values and recreate the container

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

Disable the sqlExpressions feature toggle (in grafana.ini: [feature_toggles] sqlExpressions = false) and restart Grafana.
Alternatively do ALL of: update the Sqlyze plugin to at least v1.5.0 or disable it, and disable all installed AWS data sources. Grafana notes these workarounds reduce but do not fully remove the risk.

Related vulnerabilities

CVE-2026-27880

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.