CVE-2026-22638
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: SICK AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grafana | grafana | * |
| grafana | image_renderer | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) issue in Grafana caused by a combination of client path traversal and an open redirect. Attackers can redirect users to a malicious website hosting a frontend plugin that executes arbitrary JavaScript. It does not require editor permissions, and if anonymous access is enabled, the XSS can be exploited. Additionally, if the Grafana Image Renderer plugin is installed, the open redirect can be exploited to perform a full read SSRF (Server-Side Request Forgery). The default Content-Security-Policy in Grafana blocks the XSS via the 'connect-src' directive.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary JavaScript in the context of Grafana users, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions. If anonymous access is enabled, any user can be affected without needing special permissions. Exploiting the open redirect with the Grafana Image Renderer plugin can also lead to SSRF attacks, which may allow attackers to read internal resources. Overall, this can compromise confidentiality, integrity, and availability of the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should disable anonymous access in Grafana if it is enabled, as the XSS works when anonymous access is allowed. Additionally, review and harden the Content-Security-Policy (CSP) settings, especially the 'connect-src' directive, to block malicious scripts. If the Grafana Image Renderer plugin is installed, consider disabling or updating it to prevent SSRF exploitation. Also, apply any available patches or updates from Grafana addressing this issue.