Loading story…
Grafana issued urgent patches for two high-severity vulnerabilities, including CVE-2026-27876, a critical flaw in the SQL Expressions feature that can allow an attacker with Viewer privileges or higher to write arbitrary files to the server and potentially escalate to full remote code execution. The issue can be chained into broader compromise scenarios, including unauthorized SSH access, prompting public warnings from national defenders such as Belgium’s CCB to patch immediately.
Grafana also fixed CVE-2026-27880, which affects OpenFeature validation endpoints and allows unauthenticated attackers to crash vulnerable instances by sending oversized requests that exhaust memory. Grafana Labs said patched releases, including 12.4.2, are available and noted that Amazon Managed Grafana and Azure Managed Grafana were already protected under embargo; for temporary mitigation, administrators were advised to disable the sqlExpressions feature toggle and use highly available deployments and reverse proxies such as Nginx or Cloudflare to restrict request sizes.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Alongside the fixes, Grafana advised administrators who could not patch immediately to disable the sqlExpressions feature toggle and use highly available deployments and reverse proxies such as Nginx or Cloudflare to limit DoS payload sizes.
Belgium's Centre for Cybersecurity Belgium published an advisory warning about remote code execution and injection vulnerabilities in Grafana and urged organizations to patch immediately.
Grafana noted that Amazon Managed Grafana and Azure Managed Grafana were already protected before public disclosure under embargo. This indicated coordinated pre-release mitigation for major managed service providers.
Grafana released urgent security updates, including version 12.4.2, to fix CVE-2026-27876 and CVE-2026-27880. The flaws could allow remote code execution via the SQL Expressions feature and unauthenticated denial-of-service through oversized requests to OpenFeature validation endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceccb.belgium.be
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grafana Labs released **Grafana 12.4.2** and issued security updates for the **12.3**, **12.2**, **12.1**, and **11.6** release lines to fix two vulnerabilities tracked as **`CVE-2026-27876`** and **`CVE-2026-27880`**. The company described the issues as **critical** and **high severity**, indicating that multiple supported versions were affected and required immediate remediation. Grafana urged users to upgrade to the newly released patched versions as soon as possible to reduce exposure. The advisory was amplified by security community channels, underscoring the urgency for organizations running self-managed Grafana deployments to identify affected instances and apply the vendor fixes promptly.
Jun 29, 2026
German government CERT advisories reported **multiple vulnerabilities in Grafana**, the widely used observability and dashboard platform. Two separate dCERT notices identified Grafana as affected, indicating that security issues were disclosed across more than one advisory rather than as a single isolated flaw. The advisories provide limited public detail, but the repeated notices indicate an ongoing need for organizations running Grafana to review vendor guidance, identify affected versions, and apply available patches or mitigations. Because Grafana is commonly deployed to monitor infrastructure, applications, and security telemetry, unpatched weaknesses could expose sensitive operational data or create opportunities for further compromise depending on the impacted components.
Jun 29, 2026
Grafana patched **CVE-2026-19516**, a critical SSRF vulnerability with a CVSS score of 9.1 in the Grafana MCP server's `grafana_api_request` tool. The flaw allowed callers to control outbound HTTP requests through a supplied `X-Grafana-URL` header, potentially reaching internal services accessible from the MCP server and reading their responses. In tested deployments, the issue could expose sensitive data such as AWS IMDSv2 credentials. Researchers also found that attacker-generated values matching the expected session-ID format could bypass session validation and invoke MCP tools, including `tools/list` and `tools/call`, without authentication under the configured Grafana service account. Grafana addressed both issues in version 1.1.0 by fixing the SSRF condition and adding optional bearer-token authentication; operators should enforce authentication on remote MCP deployments, restrict service-account privileges, and apply strict outbound destination filtering.
Sep 4, 2026