{
  "claim": {
    "argus_claim_ref": null,
    "attacker_control": null,
    "claimed_surface": null,
    "expected_impact": null,
    "finding_id": null,
    "id": null,
    "required_entrypoint_detail": null,
    "required_entrypoint_kind": "authenticate",
    "submission_reason": "ticket_derived",
    "trigger_class": null,
    "upstream_verdicts": null
  },
  "latest_description": "Grafana v11.6.0+ SQL Expressions feature allows authenticated users (Viewer+) to write arbitrary files via malicious SQL queries. Chain: 1) Login, 2) Craft SQL Expression query, 3) Overwrite Sqlyze driver binary (<v1.5.0) or AWS config, 4) RCE. Prerequisites: sqlExpressions feature toggle enabled, vulnerable plugin.",
  "product": "Grafana",
  "severity": "critical",
  "status": "open",
  "summary": "Grafana SQL Expressions RCE",
  "ticket_id": "CVE-2026-27876"
}