What is the CVSS score of CVE-2026-27876?

CVE-2026-27876 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Grafana are affected by CVE-2026-27876?

A critical remote code execution vulnerability in Grafana enables authenticated administrators to achieve complete system compromise through a chained SQL expression attack.. A patch is available.

How to fix or mitigate CVE-2026-27876?

Within 24 hours: Audit all Grafana instances for sqlExpressions feature toggle status and disable the feature immediately on all affected deployments; restrict administrative access to Grafana to only essential personnel and enforce multi-factor authentication on all admin accounts. Within 7 days: Review access logs for suspicious administrative activity and credential compromise indicators; identify and isolate any Grafana Enterprise plugin deployments tied to SQL expression functionality. Within 30 days: Monitor Grafana security advisories for patch release; deploy patched versions to all instances as soon as vendor releases a fix, prioritizing Enterprise deployments.

Grafana CVE-2026-27876

EUVD-2026-16634 CRITICAL

Code Injection (CWE-94)

2026-03-27 GRAFANA

Grafana RCE Code Injection Grafana Enterprise

9.1

CVSS 3.1 · Vendor: GRAFANA

Severity by source

Vendor (GRAFANA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.1 CRITICAL

qualitative

Primary rating from Vendor (GRAFANA).

CVSS VectorVendor: GRAFANA

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 10, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 14:45 euvd

EUVD-2026-16634

Analysis Generated

Mar 27, 2026 - 14:45 vuln.today

CVE Published

Mar 27, 2026 - 14:24 nvd

CRITICAL 9.1

DescriptionCVE.org

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.

Only instances with the sqlExpressions feature toggle enabled are vulnerable.

AnalysisAI

Remote code execution is achievable in Grafana installations through a chained attack combining SQL Expressions with a Grafana Enterprise plugin, affecting both open-source and Enterprise deployments. The vulnerability requires high-privilege authenticated access (PR:H) but enables cross-scope impact with complete system compromise once exploited. Only instances with the sqlExpressions feature toggle enabled are vulnerable, though Grafana recommends all users update to prevent future exploitation paths using this attack vector. No public exploit identified at time of analysis, and authentication as a high-privilege user is required per CVSS vector.

Technical ContextAI

This vulnerability affects Grafana Enterprise and related products as identified by CPE cpe:2.3:a:grafana:grafana_enterprise:*:*:*:*:*:*:*:*. The attack chain leverages the SQL Expressions feature in Grafana OSS combined with functionality in a Grafana Enterprise plugin to achieve arbitrary code execution. SQL Expressions is a feature toggle that enables SQL-based data transformations and queries within Grafana dashboards. The chained nature indicates multiple components must interact to create the exploitable condition, suggesting the vulnerability arises from inadequate input validation or sandboxing across plugin boundaries when SQL expressions are processed. The Changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond its original security context, typical of code execution flaws that break out of application containment.

RemediationAI

Update Grafana installations to the patched version specified in the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-27876. Patch available per vendor advisory, though specific fixed version numbers are not provided in the intelligence data. As an interim mitigation for environments unable to patch immediately, disable the sqlExpressions feature toggle to eliminate the attack vector. Additionally, audit and restrict administrative access privileges to minimize the pool of accounts with PR:H level permissions capable of exploiting this vulnerability. Review Grafana Enterprise plugin configurations to identify and assess risk from plugin interactions with SQL Expressions functionality.

More in Grafana

View all

CVE-2023-34111 CRITICAL Act Now POC

9.8 Jun 06

The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili

CVE-2022-26148 CRITICAL Act Now POC

9.8 Mar 21

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this

CVE-2020-27846 CRITICAL Act Now POC

9.8 Dec 21

A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2018-15727 CRITICAL Act Now POC

9.8 Aug 29

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat

CVE-2024-9264 CRITICAL Act Now POC

9.4 Oct 18

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.

CVE-2026-63087 CRITICAL Monitor POC

9.3 Jul 16

Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok

CVE-2023-36649 CRITICAL Act Now POC

9.1 Dec 12

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re

CVE-2025-4123 HIGH This Week POC

7.6 May 22

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire

CVE-2020-13379 HIGH This Week POC

8.2 Jun 03

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS

CVE-2023-1387 HIGH This Week POC

7.5 Apr 26

Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability

CVE-2022-32276 HIGH This Week POC

7.5 Jun 17

Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (

CVE-2022-32275 HIGH This Week POC

7.5 Jun 06

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2012-0158 HIGH POC

8.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-1273 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Manager Client Tools 15	Fixed
SUSE Manager Client Tools for SLE 15	Fixed
SUSE Multi-Linux Manager Client Tools for SLE 15	Fixed
openSUSE Leap 15.6	Fixed

CVE-2026-27876 vulnerability details – vuln.today

Back

Grafana CVE-2026-27876

Severity by source

CVSS VectorVendor: GRAFANA

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Grafana

Same weakness CWE-94 – Code Injection

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code