critical 9.9

CVE-2024-9264 in the critical feed json

Grafana SQL Expressions allow for remote code execution

published 2024-10-18 2 y ago modified 2026-11-04 5 d ago also BIT-grafana-2024-9264 , EUVD-2024-3110 , GHSA-q99m-qcv4-fpm7 , GO-2024-3215

cvss: 9.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 97.6%; EPSS 97.6% chance of exploitation in 30 days, percentile 99.9%
public exploits: 1; Metasploit, plus a Nuclei check

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Patch / fix

fixed in 3 distros 3 links 1

go github.com/grafana/grafana 11.0.6+security-01, 11.1.7+security-01, 11.2.2+security-01
bitnami grafana 11.2.2
Grafana Grafana +security-01, 11.0.5, 11.0.5\+security-01, 11.0.6, 11.0.6\+security-01, 11.1.6, 11.1.6\+security-01, 11.1.7, 11.1.7\+security-01, 11.2.1, 11.2.1\+security-01, 11.2.2, 11.2.2\+security-01

suse opensuse alpine

grafana SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 11.5.5-150200.3.72.2
grafana Manager Client Tools 15 11.5.5-150000.1.79.1
prometheus-blackbox_exporter openSUSE Leap 15.6, Manager Proxy Module 4.3, Manager Client Tools for SLE Micro 5 +1 more 0.26.0-150000.1.27.1
golang-github-prometheus-prometheus Manager Client Tools 15 2.53.4-150000.3.62.2
grafana Manager Client Tools 12 11.5.5-1.79.2
prometheus-blackbox_exporter Manager Client Tools 12 0.26.0-1.27.1
golang-github-prometheus-prometheus Manager Client Tools 12 2.53.4-1.60.2
golang-github-prometheus-alertmanager Manager Client Tools 12 0.26.0-1.31.2

suse advisories SUSE-SU-2025:01991-1 SUSE-SU-2025:01989-1 SUSE-SU-2025:01987-1 SUSE-SU-2025:01985-1 SUSE-SU-2024:3911-1

govulncheck-vulndb Package Hub 12 0.0.20241104T154416-5.1
govulncheck-vulndb openSUSE Tumbleweed 0.0.20241030T212825-1.1
grafana openSUSE Tumbleweed 11.3.0-1.1

opensuse advisories openSUSE-SU-2024:0350-1 openSUSE-SU-2024:14447-1 openSUSE-SU-2024:14431-1

grafana Alpine 3.20 11.0.7-r0

alpine advisories ALPINE-CVE-2024-9264

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/grafana/grafana#81666 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-9264 updated 2026-11-04 cvss 9.9

grafana: Command injection and local file inclusion via SQL Expressions

Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat Storage 3 grafana
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2024-10-17 First public exploit (Metasploit exploit/multi/http/grafana_sql_expressions_rce_cve_2024_9264)
2024-10-18 Published

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-11-01)

Exploit prediction

97.55% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/http/grafana_sql_expressions_rce_cve_2024_9264 Grafana SQL Expressions DuckDB Command Injection metasploit exploit, excellent rank, 2024-10-17
Nuclei template Grafana Post-Auth DuckDB - SQL Injection To File Read nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/grafana/grafana	>=11.0.0, <11.0.6+security-01 >=11.1.0, <11.1.7+security-01 >=11.2.0, <11.2.2+security-01 all versions	11.0.6+security-01 11.1.7+security-01 11.2.2+security-01
bitnami	grafana	>=11.0.0, <11.2.2	11.2.2

Affected products

Grafana Grafana

Classification

Weakness

CWE-94 Improper Control of Generation of Code
CWE-77 Improper Neutralization of Special Elements used in a Command

References

github.com /grafana/grafana/pull/81666
web, patch
grafana.com /security/security-advisories/cve-2024-9264/
vendor-advisory, advisory
security.netapp.com /advisory/ntap-20250314-0007/
web
nvd.nist.gov /vuln/detail/CVE-2024-9264
advisory, web
github.com /grafana/grafana
package
grafana.com /blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264
web
grafana.com /security/security-advisories/cve-2024-9264
web
security.netapp.com /advisory/ntap-20250314-0007
web
github.com /advisories/GHSA-q99m-qcv4-fpm7
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary