Grafana OnCall CVE-2026-63087

Exploitation requires network reachability to the OnCall internal plugin install endpoint and knowledge of the default stack_id and org_id values - but those values are hardcoded constants present in the public source tree, so they are not a meaningful barrier. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), there are no special conditions: remote unauthenticated exploitation works against default configurations of Grafana OnCall through 1.16.11, with no user interaction and no valid credentials needed. The primary limiting factor is exposure - an instance whose internal API/plugin-install endpoint is not reachable by the attacker (e.g., properly segmented so only the local Grafana can reach it) is not exploitable; non-default stack_id/org_id values would also raise the bar but the default install is vulnerable out of the box.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact - and the description corroborates every one of those metrics rather than contradicting them, so there is no vector-vs-description conflict to flag. Publicly available exploit code (a documented write-up and the VulnCheck advisory) materially lowers the bar to weaponization. Tempering the urgency: the vulnerability is NOT listed in CISA KEV and no EPSS score was provided in the input, so real-world exploitation is not confirmed and its probability cannot be quantified from available data - treat exploitation as feasible and easy but not yet observed at scale. No SSVC decision values were supplied; based on the vector, exploitation would be highly automatable with total technical impact, which argues for prompt patching of any internet-exposed instance.

An attacker locates an internet-reachable Grafana OnCall instance and sends an unauthenticated POST to the internal plugin install endpoint using the hardcoded default stack_id and org_id from the public source, receiving a valid PluginAuthToken in response. Using that token they create an Admin user through the user-context header bootstrap path and overwrite grafana_url/api_token to redirect OnCall-to-Grafana calls to their own host, harvesting credentials and controlling alerting. A public exploit write-up demonstrating this chain already exists, and the CVSS AV:N/AC:L/PR:N/UI:N vector confirms it needs only network access with no authentication or user interaction.