CVE-2026-17033 CVE Record (Grafana Grafana OSS)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 12 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GRAFANA
- Statut NVD
- Awaiting Analysis
Description
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L | GRAFANA |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L | NVD · security@grafana.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-64887
- GCVE · GCVE-0-2026-17033
Avis du CERT-FR
- CERTFR-2026-AVI-1291 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Grafana · Grafana OSS | affected 0 ≤ 12.3.11 ; affected 12.4.0 ≤ 12.4.9 ; affected 13.0.0 ≤ 13.0.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |