Loading vulnerability…
CVE-2026-27876 is a critical Grafana vulnerability in the SQL Expressions feature that can be used as part of a chained attack with a Grafana Enterprise plugin to achieve remote arbitrary code execution. According to the provided content, the flaw is enabled by Grafana OSS functionality and affects only instances where the sqlExpressions feature toggle is enabled. The issue allows an attacker with sufficient privileges to write arbitrary files to the Grafana server filesystem. The provided context further states that this arbitrary file write can be used to overwrite a Sqlyze driver or manipulate an AWS data source configuration file, and then be chained into full RCE, including unauthorized SSH access to the underlying host in some scenarios. Affected versions are 11.6.0 through 11.6.13, 12.0.0 through 12.1.9, 12.2.0 through 12.2.7, 12.3.0 through 12.3.5, and 12.4.0 through 12.4.1.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
sqlExpressions feature toggle, since only instances with that feature enabled are vulnerable. Restrict query execution privileges to the minimum necessary, because the provided context states exploitation requires Viewer permissions or higher to execute data source queries. Where possible, reduce exposure of Grafana instances and limit access to Enterprise plugins and sensitive filesystem paths until patched versions are deployed.Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This nine-file repository provides an operational Python PoC for CVE-2026-27876, an authenticated Grafana SQL Expressions arbitrary-file-write vulnerability. The main entry point, poc/exploit.py, constructs a parenthesized UNION ALL SQL expression using INTO OUTFILE and submits it to Grafana's built-in __expr__ datasource through POST /api/ds/query. The stated bypass relies on SetOp AST traversal not visiting its Into child, allowing a forbidden file-output clause to evade validation. The exploit can check feature availability, write supplied content or a local file to an attacker-selected server path, and attempt command execution through cron or Grafana datasource provisioning. The repository also includes a Docker-based Grafana 12.4.0 lab with sqlExpressions enabled, a custom entrypoint that starts BusyBox cron, and a setup script that starts the lab, creates a Viewer account, and probes the expression API. Documentation supplies root-cause discussion, affected/fixed version ranges, CVSS rationale, and cleanup instructions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical Grafana vulnerability in the SQL expressions feature that allows arbitrary file write and can be chained to achieve remote code execution.
A remote arbitrary code execution vulnerability affecting Grafana environments where the sqlExpressions feature toggle is enabled, involving a chained attack via SQL Expressions and a Grafana Enterprise plugin.
A critical or high-severity vulnerability addressed by Grafana in affected versions prior to 12.4.2, 12.3.6, 12.2.8, 12.1.10, and 11.6.14.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.