Detections
Analytics
Alpine: multiple grafana packages: security update to 11.0.7-r0
critical Tenable Self-Hosted Container Security Plugin ID 426559
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with
permission to write external alert instances to also write alert rules. (CVE-2024-8118)
- The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries
containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading
to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher
permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for
this attack to function; by default, this binary is not installed in Grafana distributions.
(CVE-2024-9264)
See Also
Plugin Details
Severity: Critical
ID: 426559
Version: Revision 1.4
Type: Local
Published: 5/16/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.48
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2024-9264
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.4
Threat Score: 9.4
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/26/2024
Reference Information
CVE: CVE-2024-8118, CVE-2024-9264
IAVB: 2024-B-0142-S