PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17033 Grafana CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-24T14:16:50.717Z and has not been modified since then. CVE-2026-17033 is a vulnerability in Grafana that allows an authenticated attacker with Editor access or alert.instances.external:write permissions to submit an external Alertmanager alert with a controlled generatorURL. When a user with read access clicks 'See source', the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions. The vulnerability is due to Grafana rendering alert.generatorURL directly without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. Grafana administrators and users with Editor access or alert.instances.external:write permissions should be aware of this vulnerability and take steps to mitigate it. Additionally, users who interact with Grafana dashboards and click on 'See source' links should be cautious of potential JavaScript execution.

Vendor
Grafana
Product
Grafana OSS
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-24
Original CVE updated
2026-08-31
Advisory published
2026-08-24
Advisory updated
2026-08-31

Who should care

Grafana administrators and users with Editor access or alert.instances.external:write permissions should be aware of this vulnerability and take steps to mitigate it. Additionally, users who interact with Grafana dashboards and click on 'See source' links should be cautious of potential JavaScript execution.

Technical summary

CVE-2026-17033 is a vulnerability in Grafana that allows an authenticated attacker with Editor access or alert.instances.external:write permissions to submit an external Alertmanager alert with a controlled generatorURL. When a user with read access clicks 'See source', the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions. The vulnerability is due to Grafana rendering alert.generatorURL directly without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment.

Defensive priority

Authenticated attackers with Editor access or alert.instances.external:write permissions can submit external alerts with controlled generatorURL, leading to JavaScript execution in another user's Grafana session when they click 'See source'.

Recommended defensive actions

  • Inventory and assess Grafana instances for exposure to untrusted users.
  • Restrict Editor access and alert.instances.external:write permissions to trusted users.
  • Implement URL scheme sanitization and a safe-protocol allowlist for alert.generatorURL.
  • Monitor for suspicious alert submissions and user interactions.
  • Apply vendor patches or updates when available.

Evidence notes

The CVE-2026-17033 record indicates an authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert with a controlled generatorURL. Grafana renders alert.generatorURL directly without URL-scheme sanitization or a safe-protocol allowlist, allowing JavaScript execution when a user clicks 'See source'. The CVSS score is 6.8, and the severity is MEDIUM.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17033 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17033

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17033 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17033

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.