CVE-2026-17033: CVE Record
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs authenticated Editor access or the alert.instances.external:write permission to create an external Alertmanager alert. Exploitation also requires a separate user with read access to click the alert's See source link.
What permissions does the attacker gain?
The injected JavaScript executes in the Grafana origin with the permissions of the user who clicks See source. The attacker cannot directly execute script in another user's session without that user clicking the crafted link.
Are users exposed merely by viewing the alert?
The provided information identifies the Alert Details See source LinkButton as the execution point. A user must click See source for the browser to execute the attacker-controlled JavaScript.