Grafana -- RCE on Grafana via sqlExpressions

2026-05-26 · CVE-2026-27876 · VuXML entry

https://grafana.com/security/security-advisories/cve-2026-27876 reports: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Affected versions

• grafana >= 11.6.0 < 11.6.14; >= 12.0.0 < 12.1.10; >= 12.2.0 < 12.2.8; >= 12.3.0 < 12.3.6; >= 12.4.0 < 12.4.2

By system

0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.