CVE-2026-17033Medium· 6.8▾ SunlitAn authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115754Medium· 4.7serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization (CVE-2026-115754)
CVE-2026-116148Low· 3.6ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder (CVE-2026-116148)
CVE-2026-115351Medium· 4.7mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)
CVE-2026-115350Medium· 6.1mistune: mistune: Cross-site scripting via Include directive (CVE-2026-115350)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)