CVE-2026-17033: An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL…

PriorityP338medium6.8CVSS 3.1

AVNACLPRLUIRSUCHILAL

EPSS

0.21%

11.1th percentile

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
grafana	grafana_oss	<= 12.3.11	—
grafana	grafana_oss	12.4.0 – 12.4.9	—
grafana	grafana_oss	13.0.0 – 13.0.7	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.