CVE-2026-17033 CVE Record (Grafana Grafana OSS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GRAFANA
- NVD status
- Awaiting Analysis
Description
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L | GRAFANA |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L | NVD · security@grafana.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-64887
- GCVE · GCVE-0-2026-17033
CERT-FR advisories
- CERTFR-2026-AVI-1291 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Grafana · Grafana OSS | affected 0 ≤ 12.3.11 ; affected 12.4.0 ≤ 12.4.9 ; affected 13.0.0 ≤ 13.0.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |