CVE-2026-17183

A flaw was found in Grafana's Unified Alerting component. An authenticated user with permissions to create or edit alert rules in a folder can bypass datasource query permissions. By manipulating the queryType field, an attacker can execute queries against datasources they are not authorized to access, leading to the disclosure of sensitive data. This vulnerability arises from inconsistent query classification between authorization and execution paths.

An authorization bypass vulnerability was found in Grafana's Unified Alerting engine. An authenticated user with folder permissions to create or edit alert rules can manipulate the queryType parameter to expr while supplying an arbitrary datasourceUid. Because the authorization layer misclassifies the query as a local expression and skips datasource permission checks while the evaluator executes it against the specified backend datasource, the attacker can execute unauthorized queries using Grafana's configured datasource credentials, leading to sensitive data disclosure and potential backend data tampering.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict alert rule creation and editing permissions to trusted administrators using Grafana RBAC, or enforce strict read-only and least-privilege credential scopes directly on backend datasources.