CVE-2026-21724: Missing Protected-field Authorization in Provisioning Contact Points API
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the alert.notifications.receivers.protected:write permission is not granted to the Editor role. Remove this permission from Editor or grant it only to trusted administrative roles; audit and update role assignments so only authorized users can modify protected webhook URLs.
Grafana (provisioning contact points API) alert.notifications.receivers.protected:write = revoke/limit - Compensating control
Restrict access to the provisioning contact points API and webhook management endpoints (for example via firewall, reverse proxy, or WAF) to trusted IP ranges or internal networks until the vulnerability is remediated.
- Operational
Audit provisioning/contact-points logs for unauthorized modifications and rotate any protected webhook URLs, secrets, or credentials that may have been exposed or modified by Editor-role accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21724?
The severity of CVE-2026-21724 is considered to be high due to the potential for unauthorized modification of webhook URLs.
How do I fix CVE-2026-21724?
To fix CVE-2026-21724, it is recommended to apply the latest security updates provided by Grafana Labs that address the authorization bypass issue.
Who is affected by CVE-2026-21724?
CVE-2026-21724 affects users of Grafana OSS with the Editor role who have access to the provisioning contact points API.
What impact does CVE-2026-21724 have on Grafana OSS?
CVE-2026-21724 allows unauthorized users to modify sensitive webhook URLs, which can lead to potential data exposure or service disruption.
Is there a workaround for CVE-2026-21724?
Currently, the best workaround for CVE-2026-21724 is to limit access to the provisioning contact points API to trusted users only until a patch is applied.