CVE-2026-17033 in Grafana
Summary
by MITRE • 08/24/2026
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
This vulnerability represents a critical stored cross-site scripting flaw within the Grafana alerting subsystem, specifically affecting components that render external Alertmanager alerts. The core issue stems from an improper neutralization of special elements during output generation, categorized under CWE-79 in industry standards for web application security flaws. An authenticated attacker possessing Editor access or specific permissions to write external alert instances can inject a malicious payload by controlling the generatorURL field associated with an alert definition. While the attacker is restricted from directly executing scripts within another user's session through standard API endpoints, they exploit the rendering logic of the Alert Details interface to achieve remote code execution indirectly.
The technical mechanism relies on how Grafana processes and displays the generatorURL value when a user interacts with the See source link button. The application constructs an HTML anchor element where the href attribute is populated directly with the attacker-controlled URL string without implementing adequate sanitization or validating against a safe-protocol allowlist. This lack of input validation allows for the injection of JavaScript URIs rather than standard HTTP or HTTPS links. Although Grafana employs client-side click interceptors designed to detect and block navigation to non-safe protocols using heuristics such as looking for ://, these defenses are insufficiently robust against obfuscation techniques.
The bypass is achieved by embedding the colon-slash-slash sequence within a JavaScript comment structure inside the URL string. This technique effectively neutralizes the client-side heuristic check because the parser does not recognize the protocol delimiter in its expected position due to the intervening comment syntax. Consequently, when an authorized user with read access clicks the See source link, the browser interprets the href attribute as a valid JavaScript URI and executes the embedded script code within the context of the Grafana origin. This execution occurs under the security privileges of the clicking user rather than the attacker who created the alert, leading to session hijacking or unauthorized actions performed on behalf of the victim.
The operational impact is severe, as it allows for full compromise of authenticated sessions without requiring additional authentication factors or privilege escalation beyond initial Editor-level access. Attackers can steal sensitive data, modify configurations, exfiltrate credentials stored in local storage, or perform arbitrary API calls using the victim's session cookies and tokens. This vulnerability undermines the trust model of multi-tenant deployments where users rely on role-based access controls to isolate their activities from other tenants or lower-privileged accounts within the same instance.
Mitigation strategies must focus on implementing strict output encoding and validating URLs against a whitelist of allowed schemes such as http, https, ftp, and mailto before rendering them in HTML attributes. Server-side validation is essential to ensure that no malicious payloads reach the client side for rendering. Additionally, deploying Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts can be loaded or executed. Updating Grafana to versions where this specific parsing logic has been hardened and comment-based bypasses are neutralized is the primary remediation path for affected deployments until patches are applied.