CVE-2026-17033
published 2026-08-24CVE-2026-17033: An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL…
PriorityP337medium6.8CVSS 3.1
AVNACLPRLUIRSUCHILAL
EPSS
0.22%
11.4th percentile
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana_oss | <= 12.3.11 | — |
| grafana | grafana_oss | 12.4.0 – 12.4.9 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.7 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Grafana up to 12.3.11/12.4.9/13.0.7 Alert Details cross site scripting (EUVD-2026-64887)
vuldb·2026-08-27·CVSS 6.8
CVE-2026-17033 [MEDIUM] Grafana up to 12.3.11/12.4.9/13.0.7 Alert Details cross site scripting (EUVD-2026-64887)
A vulnerability was found in Grafana up to 12.3.11/12.4.9/13.0.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Alert Details. The manipulation results in cross site scripting.
This vulnerability is known as CVE-2026-17033. It is possible to launch the attack remotely. No exploit is available.
GHSA
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL.
ghsa_unreviewed·2026-08-24
CVE-2026-17033 [MEDIUM] CWE-79 An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL.
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-24
Published