CVE-2026-17033

A flaw was found in Grafana. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the click interceptor's security heuristic. This can lead to a Cross-Site Scripting (XSS) vulnerability, where a user with read access who clicks the 'See source' link will execute attacker-controlled JavaScript in their browser with the permissions of the clicking user, potentially leading to information disclosure or unauthorized actions.

A cross-site scripting (XSS) vulnerability was found in Grafana's Alertmanager integration. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an alert containing a crafted generatorURL that bypasses URL sanitization heuristics using JavaScript comment syntax. When another user views the alert details and clicks the "See source" button, the attacker's script executes within the victim's browser session under Grafana's origin. This enables session hijacking, unauthorized API actions, and access to all dashboards and datasources visible to the victim.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict alert creation and external Alertmanager submission permissions (alert.instances.external:write) to trusted administrators using Grafana RBAC. Advise operators to refrain from clicking the "See source" link on unverified external alerts.