EUVD-2026-30145
GHSA-gxcp-jjxh-rwp4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
AnalysisAI
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlExpressions feature toggle is enabled. Affected versions span the 11.6.x, 12.x, and 13.0.x release trains, with fixed security builds available across all affected branches. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the confidentiality impact is rated High by CVSS due to the potential for unrestricted file disclosure from the Grafana server's filesystem.
Technical ContextAI
Grafana OSS (cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*) supports a SQL Expressions feature that, when enabled via the sqlExpressions feature toggle, allows users to write SQL-like queries processed server-side. The root cause is classified as CWE-552 (Files or Directories Accessible to External Parties), meaning the application fails to adequately restrict which filesystem paths are accessible when constructing or evaluating SQL expressions. This is effectively a path traversal vulnerability triggered through the expression evaluation engine rather than a traditional HTTP path parameter. The scope change (S:C) in the CVSS vector reflects that the vulnerability crosses a security boundary - the Grafana application process can access files outside its intended data scope on the underlying OS filesystem. Red Hat and SUSE are listed as downstream distributors affected by this issue, suggesting it impacts Grafana packages shipped in enterprise Linux distributions.
RemediationAI
The primary remediation is to upgrade Grafana OSS to the appropriate security-patched release for your branch: 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, or 13.0.1+security-01, as detailed in the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-33380. For organizations unable to patch immediately, the most effective compensating control is to disable the sqlExpressions feature toggle in the Grafana configuration, which eliminates the vulnerable code path entirely - this has the trade-off of disabling SQL Expression functionality for all users until patching is complete. Additionally, restricting Grafana access to trusted internal networks or requiring VPN for access reduces the remote attack surface, though this does not address insider-threat scenarios. Red Hat and SUSE customers should apply distribution-specific patches when available through their respective channels.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today