CVE-2026-17033
Received Received - Intake

Stored XSS in Grafana via Alertmanager generatorURL

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Grafana Labs

Description
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-17033
EUVD
EUVD-2026-64887

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grafana grafana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated attacker with Editor access or specific alert permissions to inject a malicious URL into an Alertmanager alert. When a user clicks the 'See source' link, the browser executes attacker-controlled JavaScript in the Grafana interface with the user's permissions.

Detection Guidance

This vulnerability involves malicious JavaScript execution via crafted Alertmanager alert URLs in Grafana. Detection requires checking for unauthorized alert configurations and suspicious generatorURL values containing javascript: or similar payloads in Grafana's alerting system.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or access sensitive data within Grafana. Users with read access could unknowingly execute malicious scripts when viewing alerts.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade Grafana to the latest patched version immediately to address the URL sanitization flaw in alert.generatorURL rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart