Which versions of Grafana OnCall are affected by CVE-2026-63087?

Grafana OnCall through version 1.16.11 contains a critical authentication bypass (CVE-2026-63087, CVSS 9.3) allowing unauthenticated remote attackers to assume full administrative control of OnCall…

Is there a public PoC exploit available for CVE-2026-63087?

Yes, a public proof-of-concept exploit is available for CVE-2026-63087. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-63087?

Within 24 hours: inventory all Grafana OnCall instances and identify those running version 1.16.11 or earlier; immediately restrict network access to the OnCall plugin installation endpoint to internal networks only and implement mandatory authentication checks at your reverse proxy or WAF layer. Within 7 days: enable comprehensive audit logging on admin user creation and plugin token generation; add alerting for any new admin user accounts; enforce MFA on all existing admin accounts; review and revoke any unexplained PluginAuthTokens; inspect grafana_url and api_token configurations for unauthorized modifications. Within 30 days: monitor Grafana vendor advisories for patch release; if no patch is released by Day 45, segment OnCall infrastructure behind additional network controls and evaluate temporary failover to alternative alerting platforms; audit all admin actions and API redirects from the past 30 days for signs of unauthorized access.

Grafana OnCall CVE-2026-63087

Q: What is the CVSS score of CVE-2026-63087?

CVE-2026-63087 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44955 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-16 VulnCheck

GHSA-whw8-2869-jf7j

Grafana Authentication Bypass Oncall

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network exploitation with hardcoded public constants gives PR:N/AC:L; token then compromises the linked Grafana org, so scope changes (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 16:32 vuln.today

CVE Published

Jul 16, 2026 - 16:03 cve.org

CRITICAL 9.3

DescriptionCVE.org

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.

Articles & Coverage 1

News Critical Authentication Bypass in Grafana OnCall through 1.16.11 - CVE-2026-63087 Jul 16, 2026

AnalysisAI

Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthToken by POSTing to the internal plugin install endpoint with hardcoded default stack_id and org_id values exposed in the public source tree, then use that token to seize full control of the OnCall instance. With the token, an attacker can create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token to lock out operators, and redirect OnCall-to-Grafana API traffic to an attacker host by overwriting grafana_url and api_token. Publicly available exploit code exists (reported by VulnCheck), CVSS 4.0 base 9.3, though there is no public exploit identified as actively exploited - it is not on CISA KEV.

Technical ContextAI

Grafana OnCall is an on-call scheduling and incident-response/alert-routing application that runs as a Grafana plugin backed by a Django/Celery service, communicating bidirectionally with Grafana via a plugin token and an api_token/grafana_url pair. The root cause is CWE-306 (Missing Authentication for a Critical Function): the internal plugin install endpoint that issues a PluginAuthToken performs no authentication and instead trusts stack_id and org_id parameters, whose default values (typically stack_id and org_id of the self-hosted install) are hardcoded and discoverable in the open-source repository. Because these identifiers are effectively public constants rather than secrets, an attacker can replay them to make the server believe the install flow is legitimate and issue a token that all downstream internal API endpoints honor. The affected component is identified in CPE as cpe:2.3:a:grafana-cold-storage:oncall:*:*:*:*:*:*:*:* covering versions up to and including 1.16.11.

RemediationAI

No vendor-released patch version is identified in the available data, so 'No vendor-released patch identified at time of analysis' applies - do not assume absence of data means no fix exists; check the VulnCheck advisory (https://www.vulncheck.com/advisories/grafana-oncall-unauthenticated-token-hijack-via-plugin-install-endpoint) and the Grafana OnCall repository/release notes for an updated build past 1.16.11 and upgrade immediately once published. As compensating controls: place the OnCall internal API behind network segmentation or a reverse proxy and block external access to the plugin install endpoint so only Grafana itself can reach it (trade-off: requires validating that the legitimate Grafana-to-OnCall install call still succeeds internally); restrict OnCall to non-internet-facing networks or an allowlist of Grafana source IPs (trade-off: breaks any intentionally remote integrations); and monitor for anomalous Admin user creation, unexpected plugin-token revocation, and changes to the organization's grafana_url/api_token as detection for exploitation of this flaw. Given the product's uncertain long-term support status, evaluate migrating off self-hosted OnCall if no patch is forthcoming.