CVE-2025-12141

A flaw was found in Grafana's alerting system. Users with editor permissions, specifically those able to write or test alert notifications, can modify contact points created by other users. By changing the endpoint URL to a controlled server and triggering the test functionality, an attacker can capture and extract sensitive secure settings, such as authentication credentials for third-party services. This vulnerability leads to unauthorized access and potential compromise of external integrations.

This vulnerability has a Low impact on Red Hat products. The flaw in Grafana's alerting system allows an authenticated user with "Contact Point Writer" permissions (part of the Editor role) to disclose secure settings. Exploitation requires the attacker to modify an existing contact point and test it against a controlled external server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators should review and restrict user permissions within Grafana. Ensure that only trusted users are granted the "Contact Point Writer" role or any role that includes "alert.notifications:write" or "alert.notifications.receivers:test" permissions. Limiting the number of users with such elevated privileges reduces the attack surface. If the Grafana service is reconfigured, a restart may be required for changes to take effect.