What's the vulnerability?

Grafana v11.6.0+ SQL Expressions feature allows authenticated users (Viewer+) to write arbitrary files via malicious SQL queries. Chain: 1) Login, 2) Craft SQL Expression query, 3) Overwrite Sqlyze driver binary (<v1.5.0) or AWS config, 4) RCE. Prerequisites: sqlExpressions feature toggle enabled, vulnerable plugin.

Root Cause Analysis

Variant Analysis

Bypass and alternate trigger exploration (if present).
One Command

Verify with pruva-verify

Run the Pruva CLI to automatically fetch and execute the reproduction script.

pruva-verify REPRO-2026-00125
or pruva-verify CVE-2026-27876
Install: curl -fsSL https://pruva.dev/install.sh | sh

Or Run Manually

1

Download the script

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00125/artifacts/repro/reproduction_steps.sh
2

Make executable

chmod +x reproduction_steps.sh
3

Run the script

./reproduction_steps.sh
Run in a VM, container, or disposable environment. This exploits a real vulnerability.

How Pruva Reproduced This

Watch the AI agent's step-by-step process.

Loading session...