Grafana Security Updates – 31 March 2026

The addressed vulnerabilities could allow the remote attacker to execute arbitrary code, bypass authorization controls, disclose sensitive datasource configurations, perform cross-site scripting (XSS) attacks via Grafana Explore, or cause denial-ofservice attacks on the affected systems.

Sample of the addressed vulnerabilities:

1. RCE on Grafana via sqlExpressions Vulnerability (CVE-2026-27876):

• CVSS: 9.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Remote Code Execution

2. OpenFeature Evaluation API Reads Input Data with No Bounds Vulnerability (CVE-2026-27880):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial-of-Service

Sample of the affected products:

• Grafana Enterprise.
• Grafana SQL Expressions.
• Grafana Testdata Datasource.
• Grafana MSSQL Data Source Plugin.