Grafana CVE-2024-9264: SQL Expressions via DuckDB can read server files

In Grafana 11.0.0–11.1.6 and part of the 11.2 line, the SQL Expressions feature routed queries through a bundled DuckDB binary, letting an authenticated Viewer read and write files on the server. The flaw is scored 9.9, and public exploit code appeared soon after disclosure.

• Affects Grafana 11.0.0–11.1.6 and part of the 11.2 releases
• Exploitation needs SQL Expressions enabled and a duckdb binary on the search path
• Only the Viewer role, the lowest authenticated role, is required
• File reads can expose tokens, provisioning configs and cloud metadata