A chained attack leverages SQL Expressions and a Grafana Enterprise plugin to achieve remote arbitrary code execution. The vulnerability resides in how Grafana parses SQL Expression payloads, allowing injected code to be executed on the host. Successful exploitation gives an attacker complete control over the Grafana server, compromising confidentiality, integrity, and availability of any data or services hosted there. The weakness is reflected in CWE-89 (SQL Injection) and CWE-94 (Improper Control of Generation of Code).

Grafana Enterprise installations with the sqlExpressions feature toggle enabled are vulnerable. The affected versions are 11.6.0 through 11.6.13, 12.0.0 through 12.1.9, 12.2.0 through 12.2.7, 12.3.0 through 12.3.5, and 12.4.0 through 12.4.1. Version 12.0 is end‑of‑life and is not maintained. All newer releases, starting with 12.1.10, 12.2.8, 12.3.6, 12.4.2, and 13.0.0 or later, contain the fix and are not affected.

The CVSS score of 9.1 classifies the flaw as critical, and the EPSS score indicates a low average probability of exploitation in the near term, but the attack path involves only a single configuration setting and an available plugin, making it tractable for a motivated adversary. Because the flaw allows remote code execution, a successful attack would compromise an entire Grafana deployment. No publicly known exploits have been reported and the issue is not listed in CISA’s KEV catalog, but the lack of publicly available exploit code does not mitigate the risk of targeted attacks. The attack likely requires an attacker who can send a specially crafted query to the Grafana instance, which is feasible from any host that can reach the server.