We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-27876

CVE-2026-27876

Express

Severity: CRITICAL
CVSS: 9.1CVSS
Published: 2026-03-27
Last modified: 2026-03-27
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

References

https://grafana.com/security/security-advisories/cve-2026-27876

Summary

Description

References