CVE-2026-27876 RCE on Grafana via sqlExpressions
Remote attackers can execute arbitrary code via SQL Expressions in Grafana when the feature toggle is enabled, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27876?
CVE-2026-27876 is a critical code injection vulnerability in Grafana Grafana, published on 27 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.
Only instances with the sqlExpressions feature toggle enabled are vulnerable.
Only instances in the following version ranges are affected:
- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.
Which versions are affected by CVE-2026-27876?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 11.6.0 | 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2 |
Products include Grafana Grafana.
How do I fix CVE-2026-27876?
Upgrade grafana to a fixed version for your release line: 11.6.14, 12.1.10, 12.2.8 or 12.3.6.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-27876 being exploited?
There is no known exploitation of CVE-2026-27876 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-27876, GHSA-736h-475m-xhjc, MINI-22rf-pxhg-g4cj, MINI-2f89-787w-6p44, MINI-2q37-qh9f-464m, MINI-3832-r8mm-7hh8 and 13 more.