CVE-2024-9264

CVE-2024-9264 Grafana Post-Auth DuckDB SQL Injection RCE, File Read Proof of Concept PoC This PoC demonstrates the exploitation of CVE-2024-9264 using an authenticated user to perform a DuckDB SQL query and read an arbitrary file on the filesystem or execute arbitrary code remotely. Arbitrary cod...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2024-9264

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Python proof of concept for CVE-2024-9264, a Grafana SQL Expressions vulnerability that can allow authenticated local file inclusion and command execution when duckdb is available in the Grafana process PATH. For authorized testing and...

File-Read-CVE-2024-9264

File-Read-CVE-2024-9264 Proof Of Concept for File Read in Grafana CVE-2024-9264 Prerequisites authenticated Grafana user with Viewer permissions or higher DuckDB binary must be installed and accessible through Grafana's PATH Impacted version Grafana = v11.0.0 all v11.x.y are impacted Usage python...

CVE-2024-9264

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit This is a fixed version of the proof-of-concept exploit for CVE-2024-9264 , a critical remote code execution vulnerability in Grafana via SQL expressions and DuckDB. 🔗 Original advisory: Grafana Security Release ❌ Original PoC: Broken due to syntax...

CVE-2024-9264

CVE-2024-9264 Authenticated RCE in Grafana v11.0 via SQL Expressions - PoC Exploit CVE-2024-9264 - Grafana v11.0 Authenticated Remote Code Execution RCE PoC Introduction CVE-2024-9264 is a critical remote-code-execution and local-file-inclusion flaw introduced in Grafana 11’s experimental “SQL...

CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

duckdb

Jepsen DuckDB Test Jepsen tests for the DucKDB database. Runs locally, rather than on a remote cluster. The test spawns a collection of local processes which open a DuckDB file locally, and interacts with them over STDIN/STDOUT. This is an early prototype. It turns on, runs transactions, checks...

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Summary The fix for CVE-2026-47735 released 2026.06.1 is incomplete. It added a DuckDB sandbox SET GLOBAL alloweddirectories=; SET GLOBAL enableexternalaccess=false and an Arc SQL-layer denylist of the literal functions readparquet and arcpartitionagg. The sandbox correctly blocks reads outside t...

GHSA-93CM-2V4M-C56C Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Summary The fix for CVE-2026-47735 released 2026.06.1 is incomplete. It added a DuckDB sandbox SET GLOBAL alloweddirectories=; SET GLOBAL enableexternalaccess=false and an Arc SQL-layer denylist of the literal functions readparquet and arcpartitionagg. The sandbox correctly blocks reads outside t...

EUVD-2026-114443

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

CLEANSTART-2025-OD67243 SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input

Security vulnerability affects the grafana package. The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

The Arc time-series database contains a cross-database authorization bypass in versions prior to 26.06.2 . The vulnerability stems from an incomplete denylist in userSQLReadParquetPattern that fails to block specific DuckDB table-valued I/O functions such as parquet_scan, glob, parquet_metadata, ...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of "CVE-2026-47735" leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In "internal/database/sandbox.go", "alloweddirectories" uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...