Is CVE-2026-21724 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21724 being exploited in the wild.

How severe is CVE-2026-21724?

Medium severity, with a CVSS score of 5.4, published 26 March 2026.

Which products and versions are affected?

github.com/grafana/grafana (Go) < 1.9.2-0.20260323180334-daffe750de85, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.2-0.20260323180334-daffe750de85.

Is there a fix for CVE-2026-21724?

Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260323180334-daffe750de85 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21724 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-21724?

Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21724: Grafana OSS authorization bypass in provisioning contact points API

Q: Is there a fix for CVE-2026-21724?

Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260323180334-daffe750de85 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-21724 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-21724?

Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21724 · Severity: medium · CVSS 5.4 · Published 2026-03-26

Grafana OSS, a popular data visualization and monitoring platform, contains a security flaw in how it handles alert notifications. Users with the 'Editor' role can bypass intended security restrictions to modify protected webhook URLs, which are used to send alerts to external systems. This could allow an internal user to redirect sensitive alert data to an unauthorized destination or disrupt incident response workflows.

Technologies: github.com/grafana/grafana (Go). Vendors: Go.

Quick answers

Is CVE-2026-21724 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21724 being exploited in the wild.
How severe is CVE-2026-21724?: Medium severity, with a CVSS score of 5.4, published 26 March 2026.
Which products and versions are affected?: github.com/grafana/grafana (Go) < 1.9.2-0.20260323180334-daffe750de85, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.9.2-0.20260323180334-daffe750de85.
Is there a fix for CVE-2026-21724?: Yes. github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260323180334-daffe750de85 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21724 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-21724?: Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/grafana/grafana (Go): upgrade to 1.9.2-0.20260323180334-daffe750de85 or later
```
go get github.com/grafana/grafana@v1.9.2-0.20260323180334-daffe750de85
```

Technical details

An improper authorization vulnerability (CWE-285) exists in the Grafana OSS provisioning contact points API. The root cause is a missing authorization check for protected fields when updating contact points. An attacker with 'Editor' role privileges can exploit this via the network to modify webhook URLs that should be restricted by the 'alert.notifications.receivers.protected:write' permission. This allows unauthorized modification of alerting configurations. The issue is fixed in versions 11.6.14, 12.1.10, 12.2.8, and 12.3.6.

Affected products

Grafana Labs Grafana OSS >= 11.6.9, < 11.6.14; >= 12.1.5, < 12.1.10; >= 12.2.2, < 12.2.8; >= 12.3.1, < 12.3.6

Identifiers

CVE-2026-21724
GHSA-7g92-g4vh-hp84
GO-2026-5219

Timeline

2026-03-23: patched: Fix committed to repository
2026-03-25: advisory: Vendor advisory published
2026-03-26: disclosed: CVE-2026-21724 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.