---
cve: "CVE-2026-27876"
severity: "CRITICAL"
cvss: 9.1
epss: "2%"
vendor: "Grafana"
kev: false
exploited: false
published: "2026-03-27 15:16:50"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T13:37:08+01:00"
---

# CVE-2026-27876

> 9.1 CRITICAL

## Beschreibung

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.

Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Only instances in the following version ranges are affected:

- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.
- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.
- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.
- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.
- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GRAFANA**
- State: PUBLISHED
- Stand: 2026-11-03 22:13:22
- CNA-CVSS: **9.1** (`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-94** — Improper Control of Generation of Code
  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

## Angriffsmuster (CAPEC)

- [CAPEC-35 — Leverage Executable Code in Non-Executable Files](https://capec.mitre.org/data/definitions/35.html) _(Severity: Very High)_
- [CAPEC-77 — Manipulating User-Controlled Variables](https://capec.mitre.org/data/definitions/77.html) _(Severity: Very High)_
- [CAPEC-242 — Code Injection](https://capec.mitre.org/data/definitions/242.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1027.006 — Obfuscated Files or Information: HTML Smuggling](https://attack.mitre.org/techniques/T1027/006/)
- [T1027.009 — Obfuscated Files or Information: Embedded Payloads](https://attack.mitre.org/techniques/T1027/009/)
- [T1564.009 — Hide Artifacts: Resource Forking](https://attack.mitre.org/techniques/T1564/009/)

## Patch verfügbar (OSV)

- d2fdff9ee4d75c74bfd3a97c18a0b8e4d029f06e (Commit)
- 4c0e7045f97f356716755b47183b22e7f12bb4bf (Commit)

## BSI-Hinweise (deutsch)

- [Grafana: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-0899) — _BSI-Einstufung: hoch_
  Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen, Code auszuführen oder Informationen offenzulegen.

## Referenzen

- <https://grafana.com/security/security-advisories/cve-2026-27876>
- <https://access.redhat.com/security/cve/CVE-2026-27876>
- <https://bugzilla.redhat.com/show_bug.cgi?id=2452277>
- <https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27876.json>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-27876/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_