TL;DR: A critical Grafana vulnerability in sqlExpressions can be chained to remote code execution when Viewer-level access and the feature toggle are both present, according to CYCOGNITO’s analysis of CVE-2026-27876. The case shows how observability tools can become execution surfaces when feature governance and access scoping lag behind deployment convenience.
At a glance
What this is: Grafana sqlExpressions can be abused, when enabled, to turn low-privilege dashboard access into arbitrary file write and remote code execution on the host.
Why it matters: IAM and security teams need to treat feature toggles, viewer permissions, and host-level exposure as a linked control set, not separate operational concerns.
By the numbers:
- CVE-2026-27876 affects Grafana instances running versions 11.6.0 through 11.6.13, and all versions from 12.0.0 through 12.4.1.
- Information Technology at 33.6% of observed assets led exposure in the sample.
- Communication Services contributed 23.2% of observed assets.
Context
Grafana sqlExpressions is a security governance problem as much as a technical flaw because it converts a convenience feature into a potential write primitive on the server. When an observability platform can influence filesystem state, the boundary between dashboard usage and host compromise becomes much thinner than many deployment teams assume.
The identity angle matters because the exploit path depends on Viewer-level access and feature-toggle state, not just code vulnerability. That means access control, feature governance, and environment hardening have to be reviewed together, especially where Grafana is exposed across cloud, on-premises, and hybrid estates.
In practice, this is a control-plane failure pattern, not an isolated application bug. Organisations that treat advanced query features as low-risk because they sit inside a trusted internal tool are more likely to miss how quickly a benign viewing role can become an execution path.
Key questions
Q: What breaks when Grafana features like sqlExpressions are enabled without tight governance?
A: The trust boundary breaks. A feature that can write files or reach plugins turns a dashboard into an execution surface, so low-privilege access can produce host compromise even when the application looks read-only. Security teams should treat any non-default feature as part of the attack surface, not just a convenience setting.
Q: Why does Viewer-level access still create serious risk in this Grafana flaw?
A: Because the role label does not describe the full behaviour of the application path behind it. If a Viewer can reach a write primitive through a feature toggle, the attacker does not need administrative rights to progress to remote code execution. Effective privilege must be tested against real feature behaviour.
Q: What signs indicate that dashboard tooling is being used as an execution path?
A: Watch for unexpected file changes on the host, unusual query execution patterns, and plugin or driver artefacts appearing where they should not. Those symptoms suggest a normal observability workflow is being abused to stage code execution. Detection should focus on the host and the feature state together.
Q: How should teams respond to a security flaw that depends on both access scope and a feature toggle?
A: Review both controls together, not separately. If a vulnerability only exists when a feature is enabled and a specific role is present, then patching alone is not enough. Teams should disable the feature where possible, verify role scope, and treat the combination as a single governance issue.
Technical breakdown
How sqlExpressions becomes a write primitive
Grafana’s sqlExpressions feature allows SQL-driven data manipulation inside the dashboard layer, and in this case that behaviour extends far enough to write arbitrary files on the server filesystem. That is the critical mechanism: once a web feature can overwrite files, the attacker is no longer limited to dashboard data and can target configuration, drivers, or other host artefacts. File write becomes the bridge from application-level access to system-level impact. Practical implication: treat any feature that writes to disk as a privileged capability and review where it can touch executable or configuration paths.
Practical implication: classify filesystem write capability as a privileged control and restrict the feature where it is not strictly required.
Why Viewer-level access still matters
The exploit does not require full administrative access, which is why role scoping is central to the risk. Viewer-level access is often assumed to be low consequence because it is associated with read-only activity, but the vulnerability shows that a weak trust boundary inside the application can turn that assumption into a false negative. If a role can reach a dangerous code path, the nominal role name is not enough to protect the host. Practical implication: validate effective privilege against specific feature paths, not just the label on the role.
Practical implication: test low-privilege roles against dangerous feature paths instead of relying on role names alone.
Feature toggles as hidden attack surface
A disabled-by-default feature is not inert once organisations enable it for convenience or integration work. In Grafana’s case, the sqlExpressions toggle becomes part of the exposure surface as soon as it is switched on, especially in Enterprise deployments with plugins and broad data source connectivity. This is why feature governance belongs in the same review cycle as authentication and patching. Practical implication: maintain a complete inventory of enabled features and tie every non-default toggle to a documented business need and owner.
Practical implication: inventory every non-default toggle and require an explicit owner and business justification for each one.
Threat narrative
Attacker objective: The attacker’s objective is to turn limited dashboard access into host-level execution and broader environment compromise.
- Entry occurs through a network-accessible Grafana instance where the attacker already has Viewer-level access or higher and the sqlExpressions feature is enabled.
- Credential or access abuse follows when the attacker uses the permitted dashboard path to reach an arbitrary file write primitive on the server filesystem.
- Escalation occurs when the attacker overwrites a driver or writes a data source configuration file, creating a route to host-level execution and SSH access.
- Impact is remote code execution on the underlying host, with scope extending beyond the vulnerable Grafana instance itself.
Breaches seen in the wild
- Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
- ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Feature governance is now a security control, not an admin preference. Grafana’s sqlExpressions exposure shows that non-default features can materially change the attack surface even when the core product is otherwise well managed. When a feature opens a filesystem write path, its enablement must be treated as a governed exception with explicit ownership and review. Practitioners should fold feature-state auditing into baseline hardening and change control.
Least privilege fails when the application grants hidden capabilities. Viewer-level access sounds safe, but the relevant question is whether that role can reach a dangerous execution path inside the product. This is a reminder that access reviews must test effective privilege against feature behaviour, not just role descriptions. Practitioners should validate low-privilege roles against file-write, export, and plugin-adjacent paths.
Observability platforms are increasingly control surfaces. Grafana sits close to data sources, credentials, and operational workflows, which means compromise can create a path into adjacent systems rather than staying inside the dashboard. That is why monitoring tools now need the same governance discipline applied to admin consoles and integration hubs. Practitioners should align observability hardening with identity and secrets governance.
Edge-case enablement becomes the long tail of breach exposure. The article’s focus on deployments that activated sqlExpressions for convenience reflects a broader pattern: security debt accumulates where features are switched on to solve immediate operational needs. Those decisions often persist long after the original use case fades. Practitioners should track exceptional feature use as part of technical debt and risk acceptance.
OWASP-NHI relevance appears where dashboards hold operational credentials. Grafana environments commonly sit near database credentials, API keys, and cloud configurations, so a host compromise can quickly intersect with NHI governance. The vulnerability itself is not an NHI issue in isolation, but the downstream blast radius often is. Practitioners should review whether observability tooling has become an ungoverned credential hub.
What this signals
Feature-state governance is becoming part of identity security. Many platforms now expose attack paths only when a role and a feature toggle intersect, which means entitlement reviews need to account for application state as well as account scope. For teams running observability or admin tooling, the practical shift is from static access review to access-and-capability review.
Grafana-style exposure patterns also reinforce a broader operational lesson: convenience features tend to survive longer than their original use case. That is why non-default capabilities should be tracked as exceptions with an owner, a review date, and an offboarding path when they are no longer needed.
For practitioners
- Disable sqlExpressions where it is not required Remove the feature toggle from every Grafana instance that does not have a documented operational need, and recheck after upgrades or redeployments because configuration drift can silently re-enable the path.
- Scope Viewer roles against dangerous feature paths Test whether read-only users can still reach file-write or plugin-adjacent functionality, and tighten permissions where the effective behaviour exceeds the role name.
- Inventory Grafana deployments and feature states Build a complete list of OSS, Enterprise, managed, and containerised instances, then record whether sqlExpressions or similar non-default features are enabled on each one.
- Restrict network reachability to authorized internal sources Place Grafana behind internal network controls or a reverse proxy and limit who can reach the service, especially where dashboards expose sensitive data sources.
- Monitor host-level file activity and anomalous query execution Alert on unexpected filesystem changes, driver replacement attempts, and unusual query patterns that indicate a dashboard path is being used as an execution route.
Key takeaways
- Grafana sqlExpressions can turn a seemingly read-only dashboard role into a route for arbitrary file write and host compromise when the feature is enabled.
- The risk is amplified by the combination of Viewer-level access, non-default feature state, and broad data source connectivity across hybrid environments.
- Teams reduce exposure by disabling unused toggles, verifying effective privilege against real feature paths, and watching for host-level file changes tied to dashboard activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-06 — Insecure Cloud Deployment Configurations | Enabled sqlExpressions in exposed Grafana deployments creates a cloud-adjacent exposure path through configuration choice. |
| NHI-05 — Overprivileged NHI | Viewer access with hidden write capability shows how effective privilege can exceed the intended scope of a service path. | |
| Recommendation — Review Grafana deployments for insecure configuration states and disable non-essential features that widen attack paths. Limit effective access scope to the minimum feature set needed and test for privilege creep in application roles. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The flaw hinges on entitlement scope plus feature state, which maps directly to access authorization governance. |
| Recommendation — Align entitlements with actual application capabilities and verify that role scope matches runtime behaviour. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article shows that low-privilege accounts can still reach dangerous functionality when controls are mis-scoped. |
| Recommendation — Apply least-privilege checks to feature-specific paths, not just to the nominal role label. | ||
| MITRE ATT&CK | TA0006;TA0004;TA0008 — Credential Access; Privilege Escalation; Lateral Movement | The attack chain moves from access abuse to escalation and then broader host compromise. |
| Recommendation — Map the exploit path to credential access, escalation, and lateral movement to improve detection coverage. | ||
Key terms
- Feature Toggle: A feature toggle is another name for a feature flag. It lets a team switch code paths on or off at runtime, usually by evaluating a configuration value in an if statement. The technique supports staged rollout, experimentation, and rapid disablement when production behavior needs to be constrained.
- Arbitrary File Read: An arbitrary file read is a flaw that lets an attacker read files they should not access on the target system. In NHI environments, the impact often goes beyond information disclosure because the files may contain session secrets, database contents, or keys that enable impersonation or escalation.
- Viewer-Level Access: Viewer-level access is a nominally low-privilege role intended for read-only use. In practice, its real security meaning depends on the application’s feature paths, because a restricted role can still become dangerous if the product exposes privileged operations behind apparently safe interfaces.
- Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control to the broader security decisions that shape their programme.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org