# CVE-2026-27876

## Summary

Grafana SQL Expressions RCE

## Description

Grafana v11.6.0+ SQL Expressions feature allows authenticated users (Viewer+) to write arbitrary files via malicious SQL queries. Chain: 1) Login, 2) Craft SQL Expression query, 3) Overwrite Sqlyze driver binary (<v1.5.0) or AWS config, 4) RCE. Prerequisites: sqlExpressions feature toggle enabled, vulnerable plugin.

## Metadata

- Product: Grafana
- Severity: critical
- Status: open