Description

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-24T14:16:50.717Z",
  "pubdate": "2026-08-24T14:16:50.717Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw affecting Grafana.\nThe vulnerability allows an authenticated attacker to execute arbitrary JavaScript within the Grafana origin in the context of another user's session.\nThe impact includes potential session hijacking, unauthorized data access, and actions performed with the privileges of the victim user.\nThe affected system is Grafana, specifically involving the Alert Details 'See source' LinkButton component.\nThe risk implications are significant as an attacker can escalate their privileges or compromise other users, including those with higher access privileges.\nAttacker capabilities require authenticated access with Editor permissions or the alert.instances.external:write permission to submit a malicious external Alertmanager alert containing a controlled generatorURL.\nExploitation requires a victim user with read access to interact with the malicious alert by clicking the 'See source' link within the Grafana interface.",
  "technicalDetails": "The root cause of the vulnerability is the direct rendering of the alert.generatorURL property into the 'See source' LinkButton href attribute within Grafana without proper URL-scheme sanitization or enforcement of a safe-protocol allowlist.\nThe vulnerable component is the Grafana Alert Details view, specifically the LinkButton handling the alert.generatorURL parameter.\nAuthentication requirements dictate that the attacker must be authenticated and possess either Editor access or the specific alert.instances.external:write permission.\nPrivilege requirements are split: the initial payload injection requires Editor-level or specific write permissions, whereas the execution phase impacts users with read access.\nThe exploitation method relies on bypassing the click interceptor's '://' heuristic. An attacker achieves this by embedding '://' inside a JavaScript comment within the attacker-controlled generatorURL.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker with appropriate write permissions submits a crafted external Alertmanager alert containing the malicious generatorURL payload designed to bypass the click interceptor heuristic. Second, a victim user with read access navigates to the Alert Details view in Grafana. Third, the victim user clicks the 'See source' LinkButton. Fourth, the browser processes the unsanitized URL and executes the attacker-controlled JavaScript payload within the Grafana origin.\nThe payload behavior results in the execution of arbitrary JavaScript code inside the clicking user's Grafana session.\nThe post-exploitation impact includes the execution of actions on behalf of the victim user, unauthorized access to sensitive dashboard data, and potential compromise of the Grafana instance depending on the privileges of the interacting user."
}