All vulnerabilities
CVE-2024-9264

Grafana SQL Expressions allow for remote code execution

Grafana GrafanaApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationPublic exploit codeExploit module, 17 Oct 2024. Not in the KEV catalogMetasploit
Exploit odds (EPSS)97.1%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.0.5Also 11.1.6, 11.2.1 and 3 moreCVE List
Published18 Oct 2024Updated 14 Mar 2025CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Oct 2024Exploit code publicMetasploit
  2. 18 Oct 2024, 03:20 UTCPublishedCVE List

Public exploit code and templates 2

  • Exploit moduleGrafana SQL Expressions DuckDB Command Injection 17 Oct 2024Metasploit
  • Scanner templateGrafana Post-Auth DuckDB - SQL Injection To File ReadNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Text from CVE List

Affected versions 6

  • Grafanaaffected: 11.0.0 before 11.0.5CVE List
  • Grafanaaffected: 11.1.0 before 11.1.6CVE List
  • Grafanaaffected: 11.2.0 before 11.2.1CVE List
  • Grafanaaffected: 11.0.0 before 11.0.6CVE List
  • Grafanaaffected: 11.1.0 before 11.1.7CVE List
  • Grafanaaffected: 11.2.0 before 11.2.2CVE List

References 2