Grafana: SQL Expressions chained with an Enterprise plugin yields remote code execution

Impact

Where the sqlExpressions feature toggle is enabled, a chained attack through SQL Expressions and a Grafana Enterprise plugin reaches arbitrary code execution on the Grafana server. In a GPU datacenter Grafana is usually the fleet-wide observability front end: it holds datasource credentials for Prometheus, DCGM exporters, BMC metrics and often the cluster's own API, so code execution there is a credential pivot into the management plane rather than a dashboard problem. The record states high-privilege authentication is required, so the realistic actor is an existing Grafana user with elevated rights, not an anonymous one. The feature is enabled by a Grafana OSS capability, so OSS instances with the toggle on are in scope too.

Who can reach it

An authenticated Grafana user holding high privileges, over the network to the Grafana HTTP interface. Only instances with the sqlExpressions feature toggle enabled are affected.

What to do

Upgrade to a fixed release: 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2 or 13.0.0 and later. 12.0.x is end-of-life and received no fix - move off it. Immediate mitigation without an upgrade is to disable the sqlExpressions feature toggle. Either path is a Grafana service restart on the observability host; no GPU node drain and no fleet impact beyond a dashboards outage of a minute or two.

References

Related entries

• BACnet Stack open-source C library (bacnet-stack) embedded in third-party controllers and gateways: A runCVE-2026-41475 · BACnet Stack open-source C library (bacnet-stack) embedded in third-party controllers and gatewaysCritical
• Apache Airflow: docs example templated dag_run.conf into BashOperator unquoted, inviting shell injection in copied DAGsCVE-2026-42252 · Apache Airflow BashOperator documentation pattern (dag_run.conf templating)Critical
• Ceph Monitor: any read-only CephX user can dump the config-key store, including cephadm's cluster-wide SSH keyCVE-2026-50152 · Ceph Monitor (MMonSubscribe config-key store authorization)Critical
• Airflow SFTP provider: malicious remote server writes files outside the local destination directoryCVE-2026-50203 · Apache Airflow SFTP provider (SFTPHook.retrieve_directory / SFTPOperator operation=get)Critical
• NVIDIA AIStore: token-revocation endpoint accepts unauthenticated revocation listsCVE-2026-65173 · NVIDIA AIStore (token-revocation endpoint)Critical
• Apache Airflow FAB provider: Azure AD id_token issuer and audience unchecked, any tenant can log inCVE-2026-75156 · Apache Airflow FAB provider (Azure AD OAuth id_token issuer/audience validation)Critical