Grafana CVE-2026-27876

Requires Grafana (OSS or Enterprise) with the sqlExpressions feature toggle explicitly enabled. Attacker needs high-privilege authentication (admin or equivalent role) to configure SQL expressions chained with a vulnerable Enterprise plugin to achieve RCE.

The CVSS score of 9.1 (Critical) reflects the severe impact potential with complete confidentiality, integrity, and availability compromise plus changed scope. However, real-world exploitability is constrained by the requirement for high-privilege authentication (PR:H), meaning only administrative or highly trusted users can trigger the vulnerability. The network attack vector (AV:N) and low complexity (AC:L) indicate remote exploitation is straightforward once authenticated. No public exploit identified at time of analysis and no CISA KEV listing suggests this is not currently under active exploitation. The requirement for the sqlExpressions feature toggle to be enabled further limits the attack surface to a subset of Grafana deployments. While the technical impact is maximum, the narrow prerequisite conditions and lack of observed exploitation activity suggest this is a high-severity issue requiring timely patching but not an emergency requiring immediate out-of-band response for most organizations. Priority should be elevated for environments where high-privilege accounts may be compromised or where the sqlExpressions feature is actively used.

An authenticated attacker with high-privilege administrative access to a Grafana instance with sqlExpressions enabled crafts a malicious SQL expression that chains with a Grafana Enterprise plugin to inject and execute arbitrary code on the server. The low attack complexity suggests exploitation involves straightforward interaction with existing Grafana features rather than complex race conditions or timing attacks. Successful exploitation grants the attacker complete control over the Grafana server with changed scope impact, potentially enabling lateral movement to connected data sources and infrastructure managed through the Grafana installation.