Executive brief
Grafana is an open-source observability and visualization platform. An authenticated attacker with editor permissions can inject a malicious link into Alertmanager alerts that executes arbitrary JavaScript when another user clicks on it, potentially leading to account compromise or data theft.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Grafana's alert rendering logic. An authenticated attacker with Editor access or alert.instances.external:write permission can submit an external Alertmanager alert with a controlled generatorURL containing JavaScript. Grafana renders this URL directly into the Alert Details "See source" LinkButton href without sanitization or safe-protocol allowlist validation. The attack bypasses a click interceptor's :// heuristic by embedding :// inside a JavaScript comment (e.g., javascript://comment/). When a user with read access clicks "See source," the browser executes the attacker-controlled JavaScript with the clicking user's permissions in the Grafana origin. The vulnerability requires authentication and user interaction to exploit. Patches are available in Grafana 13.1.0 and later.
Affected products
- Grafana Grafana <13.1.0
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fixed in Grafana 13.1.0 and later