CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
- CVSS
- 9.9Critical
- Exploited in the wild
- Not knownPublic exploit code; not in CISA KEV
- EPSS
- 97.6%chance of exploitation in the next 30 daystop 0.1% of scored CVEsFIRST score of 11 Nov 2026
- Fix
- Patch availablesee the advisories in the references
- Published
- 18 Oct 2024analysed here 12 Nov 2026
Summary
Triage
- Attack surface
- Server-side
- Exploitable
- At runtime
- Attack vector
- network
- Can a WAF block it?
- Partly. See why
The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.
Affected products
| Product | Affected versions | Vendor says fixed in |
|---|---|---|
| Grafana | >= 11.0.0 and < 11.0.5>= 11.1.0 and < 11.1.6>= 11.2.0 and < 11.2.1>= 11.0.0 and < 11.0.6>= 11.1.0 and < 11.1.7>= 11.2.0 and < 11.2.2Vendor says fixed in: not stated |
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
Products named in our analysis
- grafana:grafana
Fix and mitigation
WAF and other mitigations
Can a WAF block it? Partly. Code injection payloads are often obfuscated, so they slip past generic WAF rules.
Also consider: remove eval sinks · RASP · input validation
Based on the weakness type only; no CVE-specific evidence yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Remediation steps (AI-written)
Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.
Exploitation evidence
- CISA KEV catalog
- Not listed as of our last sync.
- Public exploit code
- Yes: 1 Metasploit module · 14 GitHub proofs of concept · 1 Nuclei template
- CISA SSVC
- exploitation poc, automatable no, technical impact totalAssessed by CISA 1 Nov 2024 (SSVC 2.0.3). Exploitation is none, poc (public proof of concept) or active.
Metasploit
- exploit/multi/http/grafana_sql_expressions_rce_cve_2024_9264exploit, rank excellent
Nuclei
- Grafana Post-Auth DuckDB - SQL Injection To File Readdetection template, critical
GitHub proofs of concept
- nollium/CVE-2024-9264132 stars
- z3k0sec/CVE-2024-9264-RCE-Exploit38 stars
- z3k0sec/File-Read-CVE-2024-92648 stars
- Cythonic1/CVE-2024-92643 stars
and 10 more repositories
Listed so you can judge urgency, not as a recommendation to run anything. GitHub “proofs of concept” are unvetted: some are fake or carry malware. Exploit-DB marks the entries its staff verified.
Timeline
- 18 Oct 2024Published
- 19 Oct 2024First public exploit or proof of concept1 day later
- 1 Nov 2024CISA SSVC assessment: exploitation poc13 days later
- 4 Nov 2026CVE record last updated733 days (about 2 years) later
- 12 Nov 2026Analysed by vulneraibility.com9 days later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
| Metric | Value | What it means |
|---|---|---|
| Attack vector | NetworkReachable over the internet or any routable network. | Reachable over the internet or any routable network. |
| Attack complexity | LowRepeatable attack, no special conditions. | Repeatable attack, no special conditions. |
| Privileges required | LowThe attacker needs basic user privileges. | The attacker needs basic user privileges. |
| User interaction | NoneNo victim action needed. | No victim action needed. |
| Scope | ChangedImpact crosses a security boundary into other components. | Impact crosses a security boundary into other components. |
| Confidentiality | HighTotal data disclosure possible. | Total data disclosure possible. |
| Integrity | HighComplete modification possible. | Complete modification possible. |
| Availability | HighFull outage possible. | Full outage possible. |
Common questions
Is CVE-2024-9264 being exploited?
Not confirmed. CVE-2024-9264 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 98% probability of exploitation in the next 30 days.
How severe is CVE-2024-9264?
CVE-2024-9264 is rated Critical with a CVSS score of 9.9. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2024-9264?
Yes. A fix has been recorded for CVE-2024-9264. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2024-9264 affect?
CVE-2024-9264 affects grafana:grafana. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
References
2 references in the CVE record, grouped by the tags the record gives them.
Other links (2)
- grafana.com /security/security-advisories/cve-2024-9264/
- security.netapp.com /advisory/ntap-20250314-0007/
Where the data on this page comes from
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
- Metasploit Framework: exploit and scanner modules
- Nuclei templates: detection templates
- PoC-in-GitHub: GitHub repositories that claim a proof of concept
Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.
Similar CVEs
Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.