CVE-2026-17033

A flaw was found in Grafana. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the cli...

grafana: Grafana: Cross-Site Scripting (XSS) via unsanitized Alertmanager generatorURL

A flaw was found in Grafana. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the cli...

grafana: Grafana: Cross-Site Scripting (XSS) via unsanitized Alertmanager generatorURL

A flaw was found in Grafana. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the cli...

grafana: Grafana: Cross-Site Scripting (XSS) via unsanitized Alertmanager generatorURL

A flaw was found in Grafana. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the cli...

BIT-GRAFANA-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

SUSE CVE-2026-17033

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

EUVD-2026-64887

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033

Grafana OSS is vulnerable to a stored cross-site scripting (XSS) flaw in how it handles external Alertmanager alerts. An authenticated attacker with Editor access or alert.instances.external:write can submit an alert containing a crafted generatorURL field. Grafana renders this value directly as ...

Grafana OSS: Stored XSS via external Alertmanager generatorURL

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL . The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

PT-2026-80879

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. The software renders...