Grafana
The SQL Expressions experimental feature of Grafana allows for the evaluation of queries containing user input
At a glance
~41.2% estimated chance of attack in 30 days. Exploitation not confirmed.
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run Grafana and IBM Langflow, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 1 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2024-9264- 9.4 · CriticalExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity, availability, subsequent confidentiality, subsequent integrity and subsequent availability.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Not listed
- Elevated attack likelihood (~97.6% in 30 days)
These facts are for CVE-2024-9264. This event covers 9 more CVEs, each with its own record.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4.
- CVE-2026-0768 has an estimated ~23.1% chance of attack in 30 days (97.8th percentile) as of 2026-10-23 — probability signal, not confirmed exploitation
Products and services involved
- Grafana93% match confidence · CVE-2024-9264
- IBM Langflow94% match confidence · CVE-2024-9264
Pulse
Last checked 1 Nov · Recheck overdue since 2 Nov 2026, 02:08 UK time
- Story23 Oct 2026, 17:12 UK time · 23 Oct
Linked reporting from Rapid7 Blog (research).
Read source (Rapid7 Blog) - Update27 Oct 2026, 22:35 UK time · 27 Oct
Attack-likelihood ranking among CVEs first recorded at the 98.7% .
- Signal1 Nov 2026, 02:08 UK time · 1 Nov
in the next 30 days fell from 41.2% to 2.2% — now a lower likelihood signal.
3 entries so far. The timeline chart appears once this story has more history.
Sources
- Rapid7 BlogResearcher
Metasploit Wrap Up: Langflow, MongoDB, and More
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input
- ProbableSummary fact75% confidence
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2024-9264
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-0768
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-0768 has an estimated ~23.1% chance of attack in 30 days (97.8th percentile) as of 2026-10-23 — probability signal, not confirmed exploitation
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-0769
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-0769 has an estimated ~41.2% chance of attack in 30 days (98.7th percentile) as of 2026-10-23 — probability signal, not confirmed exploitation
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-10134
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-10134 has an estimated ~1.6% chance of attack in 30 days (75.7th percentile) as of 2026-10-23 — probability signal, not confirmed exploitation
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-27960
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-39980
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-39980 has an estimated ~1.3% chance of attack in 30 days (70.4th percentile) as of 2026-10-23 — probability signal, not confirmed exploitation