{"id":"CVE-2026-27876","aliases":["ALPINE-CVE-2026-27876","BIT-grafana-2026-27876","EUVD-2026-16634","GHSA-736h-475m-xhjc","SUSE-SU-2026:1524-1","SUSE-SU-2026:2243-1","SUSE-SU-2026:2258-1","SUSE-SU-2026:2265-1","UBUNTU-CVE-2026-27876","openSUSE-SU-2026:10601-1","openSUSE-SU-2026:20940-1"],"status":"published","title":"RCE on Grafana via sqlExpressions","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01963,"percentile":0.80632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89","CWE-94"],"published":"2026-03-27T14:24:36Z","modified":"2026-11-05T02:31:00Z","exploits":[{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-27876","title":"ashrafzaryouh/CVE-2026-27876","date":"2026-03-30","url":"https://github.com/ashrafzaryouh/CVE-2026-27876"},{"source":"pocgithub","id":"atiilla/CVE-2026-27876","title":"atiilla/CVE-2026-27876","date":"2026-09-05","url":"https://github.com/atiilla/CVE-2026-27876"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"grafana","fixed_in":["12.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.14","12.1.10","12.2.8","12.3.6","12.4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.6.14"},{"fixed":"12.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.6.14"},{"fixed":"12.4.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.6.0"},{"fixed":"11.6.14"},{"introduced":"12.0.0"},{"fixed":"12.1.10"},{"introduced":"12.2.0"},{"fixed":"12.2.8"},{"introduced":"12.3.0"},{"fixed":"12.3.6"},{"introduced":"12.4.0"},{"fixed":"12.4.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150002.3.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-150002.4.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-150002.3.9.3"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-bp160.1.1"}]}],"bundled":24}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-27876","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27876","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452277","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27876.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27876","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-736h-475m-xhjc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-27876","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27876.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1250367","tags":["report"]},{"url":"https://bugzilla.suse.com/1252548","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254154","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257329","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1257442","tags":["report"]},{"url":"https://bugzilla.suse.com/1257447","tags":["report"]},{"url":"https://bugzilla.suse.com/1257660","tags":["report"]},{"url":"https://bugzilla.suse.com/1257841","tags":["report"]},{"url":"https://bugzilla.suse.com/1257897","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258015","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://bugzilla.suse.com/1258418","tags":["report"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260267","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1248707","tags":["report"]},{"url":"https://bugzilla.suse.com/1259999","tags":["report"]},{"url":"https://bugzilla.suse.com/1260881","tags":["report"]},{"url":"https://bugzilla.suse.com/1261810","tags":["report"]},{"url":"https://bugzilla.suse.com/1262222","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://bugzilla.suse.com/1263986","tags":["report"]},{"url":"https://bugzilla.suse.com/1263987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262258-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262265-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249675","tags":["report"]},{"url":"https://bugzilla.suse.com/1259554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31958","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27876","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-27876","title":"RCE on Grafana via sqlExpressions","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-03-27T14:24:36.771Z","modified":"2026-11-03T22:13:22.714Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94","CWE-89"],"updated_at":"2026-11-03T23:33:09.822755Z"}],"euvd":[{"id":"EUVD-2026-16634","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-03-27T14:24:36Z","modified":"2026-11-03T22:13:22Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T23:01:34.673315Z"}],"ghsa":[{"id":"GHSA-736h-475m-xhjc","title":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote...","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.","status":"published","published":"2026-03-27T15:30:25Z","modified":"2026-03-27T18:31:26Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:06:54.610516Z"}],"nvd":[{"id":"CVE-2026-27876","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-03-27T15:16:50.92Z","modified":"2026-11-03T23:17:41.357Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-89"],"updated_at":"2026-11-04T01:48:27.339675Z"}],"osv":[{"id":"ALPINE-CVE-2026-27876","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-03-27T15:16:50.92Z","modified":"2026-11-03T06:33:02.156542698Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-27876","title":"RCE on Grafana via sqlExpressions","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-03-27T14:24:36.771Z","modified":"2026-11-05T02:31:00.984278285Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T03:08:03.500961Z"},{"id":"UBUNTU-CVE-2026-27876","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-03-27T15:16:00Z","modified":"2026-06-29T13:56:34.485986187Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"BIT-grafana-2026-27876","title":"RCE on Grafana via sqlExpressions","description":"A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.","status":"published","published":"2026-04-01T08:41:07.673Z","modified":"2026-09-08T08:47:50.84742734Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"openSUSE-SU-2026:10601-1","title":"grafana-11.6.14+security01-1.1 on GA media","description":"These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-22T00:00:00Z","modified":"2026-04-23T08:45:31.008229Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20940-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n\n- Update to version 11.6.14+security-04:\n  Security:\n  * CVE-2026-28374: Fix insecure direct object reference in\n    Annotations API (bsc#1265290)\n  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live\n    push endpoint (bsc#1265289)\n  * CVE-2026-28383: Fix unbounded memory allocation in Grafana\n    plugin resources (bsc#1265286)\n  * CVE-2026-28380: Fix broken access control in Snapshot API\n    (bsc#1265287)\n  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass\n    (bsc#1265285)\n  * CVE-2026-28379: Fix viewer-triggered race condition in\n    Grafana Live (bsc#1265288)\n  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation\n    (bsc#1265284)\n  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin\n    (bsc#1265283)\n  * CVE-2026-33381: Prevent users from generating Service Account\n    tokens after permissions removal (bsc#1265281)\n  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing\n    an authenticated attacker to read arbitrary files from the\n    Grafana server’s filesystem (bsc#1265282)\n\n- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)\n- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability\n  in Apache Thrift (bsc#1263501)\n\n- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1\n  (bsc#1258595)\n- CVE-2026-21725: Fix missing UID when deleting datasource by name\n  (bsc#1258873)\n\n- Update to version 11.6.14+security-01:\n  Security:\n  * CVE-2026-33375: Fix denial of Service via out-of-memory\n    exhaustion in MSSQL data source plugin (bsc#1260881)\n\n- Update to version 11.6.14:\n  Security:\n  * CVE-2026-27876: Fix remote arbitrary code execution via chained\n    SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fix information disclosure of data-source\n    passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fix denial of service via testdata data-source\n    (bsc#1261029)\n  * CVE-2026-27879: Fix denial of service via resample query\n    (bsc#1261027)\n  * CVE-2026-33186: Fix authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fix authorization bypass allows modification of\n    protected webhook URLs (bsc#1260878)\n\n- Update to version 11.6.13:\n  Enhancement:\n  * Wire the public dashboard service to the HTTP server\n\n- Update to version 11.6.12:\n  Enhancement:\n  * Update authentication redirect logic\n  Bug fix:\n  * Fix single panel render with variable references\n","status":"published","published":"2026-06-10T12:02:03Z","modified":"2026-06-13T18:24:19.477495413Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1524-1","title":"Security update 5.1.3 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n    \ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n    + Bumped rollup to version 4.59.0\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n    + Bumped brace-expansion to version 5.0.2\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    + Bumped google.golang.org/grpc to version 1.79.3\n    \n    \ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n  * CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  * CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:\n    \n  * Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability\n  * Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences\n  * Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: \n    + Fixed bugs involving row repeats and 'self-referencing' data links\n    + Fixed a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n\nspacecmd:\n\n- Version 5.1.13-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 5.1.26-0\n  * Fixed applying PTF with images from RPMs (bsc#1252548)\n  * Ssl Key file can miss if CA password is blank (bsc#1254154)\n  * mgrpxy ssh tuning should happens before crypto policies (bsc#1254619)\n  * Fixed default value for helm registry (bsc#1258927).\n  * Remove hub register command\n  * Optimize postgres migration disk space usage (bsc#1257447)\n  * Added continuous database backup support (bsc#1250367)\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  * Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  * Show where final tarball was generated (bsc#1259208)\n  * Set proxy config file permissions (bsc#1257660)\n- Version 5.1.25-0\n  * If PTF image doesn't exists, use the current service image (bsc#1258418)\n\n","status":"published","published":"2026-04-21T09:26:09Z","modified":"2026-04-22T08:15:49.030922Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2243-1","title":"Security update 5.0.8 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Security Fixes:\n\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)\n\ngolang-github-prometheus-node_exporter:\n\n- Backward Compatibility and packaging changes:\n  - Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains\n  - Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility\n\n- Version 1.10.2:\n  - Fixed typo in Zswap metric name (meminfo)\n\n- Version 1.10.1:\n  - Fixed mount points being collected multiple times (filesystem)\n  - Refactored mountinfo parsing (bsc#1261810)\n  - Added Zswap/Zswapped metrics (meminfo)\n\n- Version 1.10.0:\n  - New collectors: PCIe devices, swaps\n  - Added systemd virtualization metrics, AIX metrics\n  - WiFi packet metrics, additional PCIe and TLB metrics\n  - Changed mdadm to use sysfs, added erofs to excluded filesystems\n  - Fixed bugs: cpufreq collector, ethtool metrics\n\ngolang-github-prometheus-prometheus:\n    \n- Security issues fixed:\n\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret\n    being exposed in plaintext via /-/config endpoint (bsc#1263986)\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests\n    whose declared decoded length exceeds the decode limit\n    (bsc#1263987).\n  - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label\n    values in old UI heatmap chart tick labels (bsc#1262222)\n  - CVE-2026-33186: Fixed authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    * Bump google.golang.org/grpc to version 1.79.3\n  - CVE-2026-27606: Fixed arbitrary file write via path traversal in\n    rollup (bsc#1258893)\n    * Bump rollup to version 4.59.0\n\n- Other changes:\n\n  - Remote-Write: Reject snappy-compressed requests whose\n    declared decoded length exceeds the decode limit.\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)  \n\n\nprometheus-postgres_exporter:\n\n- Security Fixes:\n\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode\n    limit (bsc#1263987)\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint\n    (bsc#1263986)\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)\n\n- Highlights of other changes and bug fixes:\n\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy\n\ngrafana was updated from version 11.6.11 to 11.6.14+security01:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\nspacecmd:\n\n- Version 5.0.16-0:\n\n  - Update translation strings\n\nuyuni-tools:\n\n- Version 0.1.39-0:\n\n  - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)\n  - Fixed default value for helm registry (bsc#1258927).\n  - Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  - Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  - Show where final tarball was generated (bsc#1259208)\n\n","status":"published","published":"2026-06-03T14:10:38Z","modified":"2026-06-04T09:00:07.843013639Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2258-1","title":"Security update for grafana","description":"This update for grafana to version to 11.6.14+security01 fixes the following issues:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\n  ","status":"published","published":"2026-06-03T14:22:06Z","modified":"2026-06-04T09:00:04.530372201Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2265-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-06-03T18:02:52Z","modified":"2026-07-13T14:00:33.956635428Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}