The vulnerability in Grafana Enterprise enables an attacker to chain a SQL Expression through a plugin when the sqlExpressions feature toggle is enabled, resulting in arbitrary code execution on the host system. This flaw falls under the code‑injection class (CWE‑94) and poses a direct threat to data confidentiality, system integrity, and overall availability, potentially granting attackers full administrative control.

All Grafana Enterprise deployments that have the sqlExpressions toggle turned on are susceptible. Because the vulnerable feature resides in the open‑source core, every installation with this setting active faces the same risk until a patch is applied. No specific patched versions are noted in the advisory, so current installations should assume the vulnerability is present.

With a CVSS score of 9.1, the flaw is classified as high severity. The exploit probability is not quantified by EPSS, and it is not currently listed in the CISA KEV catalog, which neither confirms nor denies the likelihood of exploitation. Attackers can reach the vulnerable code path through the Grafana user interface or API where SQL Expressions are parsed, and because the feature is baked into the core, the attack surface is wide for any user who can configure data sources or plugins.