Description
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana OSS | ≤ 12.3.11, 12.4.0 – ≤ 12.4.9, 13.0.0 – ≤ 13.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.1.hum1 | RHSA-2026:65157 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.5.hum1 | RHSA-2026:63165 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.1.hum1 | RHSA-2026:63164 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | grafana | 12.4.10-150200.3.94.3 | SUSE-SU-2026:4600-1 |
| SLES 15 SP7 | system-user-grafana | 1.0.0-150200.5.8.1 | SUSE-SU-2026:4600-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 12.4.10-1.1 | openSUSE-SU-2026:11684-1 |
| openSUSE Leap 16.0 | grafana | 12.4.10-bp160.1.1 | openSUSE-SU-2026:22125-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 +1 | No fix yet | — |
| Wolfi rolling | grafana-12.4 | 12.4.10-r0 | — |
Advisories 8
- WID-SEC-2026-2989 Grafana: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Oct 20, 2026
- openSUSE-SU-2026:22125-1 Security update for grafana SUSE / openSUSE Security Updates · Oct 20, 2026
- RHSA-2026:65157 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63164 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63165 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2026:4600-1 Security update for grafana, system-user-grafana SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- openSUSE-SU-2026:11684-1 grafana-12.4.10-1.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-17033 vendor-advisory