CVE-2026-17033: Grafana XSS Vulnerability via Alert URL

CVE-2026-17033 Overview

CVE-2026-17033 is a stored cross-site scripting (XSS) vulnerability in Grafana's alert management interface. An authenticated attacker with Editor access or the alert.instances.external:write permission can submit an external Alertmanager alert containing a controlled generatorURL. Grafana renders this URL directly as the See source LinkButton href in the Alert Details view without URL-scheme sanitization or a safe-protocol allowlist. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin under the clicking user's session.

Critical Impact
Attackers with low-privilege alert-write permissions can execute JavaScript in higher-privileged users' Grafana sessions, enabling account takeover and data exfiltration within the Grafana origin.

Affected Products

Grafana (versions affected per vendor advisory)
Grafana deployments accepting external Alertmanager alerts
Grafana instances with users holding Editor role or alert.instances.external:write permission

Discovery Timeline

2026-08-24 - CVE-2026-17033 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-17033

Vulnerability Analysis

The vulnerability [CWE-79] resides in Grafana's rendering of external Alertmanager alert metadata. Grafana exposes a generatorURL field on alert objects, which surfaces in the Alert Details panel as a clickable See source LinkButton. The application inserts the attacker-supplied value directly into the anchor href attribute.

Grafana implements a client-side click interceptor intended to block dangerous URL schemes. That interceptor uses a :// substring heuristic to distinguish safe navigations from unsafe protocol handlers such as javascript:. An attacker bypasses the heuristic by embedding :// inside a JavaScript comment within the payload. The heuristic then classifies the URL as safe and allows navigation, causing the browser to evaluate the javascript: scheme in the Grafana origin.

Execution occurs with the clicking user's permissions. If an administrator clicks See source, the injected script runs with administrator privileges within the browser context, enabling API calls, session token access, and configuration changes.

Root Cause

The root cause is missing URL-scheme sanitization on the generatorURL field combined with a substring-based click interceptor that fails to parse URLs according to the WHATWG URL specification. Grafana trusts an attacker-controlled input for a security-sensitive DOM sink without applying a safe-protocol allowlist restricted to http, https, and other vetted schemes.

Attack Vector

An authenticated attacker with Editor role or the alert.instances.external:write scope posts an alert to the Alertmanager ingestion endpoint. The alert payload includes a crafted generatorURL using the javascript: scheme with :// placed inside a comment to defeat the interceptor. A targeted user with alert read access opens Alert Details and clicks See source, triggering script execution. The attack requires user interaction and network access to the Grafana instance. See the Grafana Security Advisory CVE-2026-17033 for further technical details.

Detection Methods for CVE-2026-17033

Indicators of Compromise

Alertmanager alert records containing generatorURL values beginning with javascript:, data:, vbscript:, or other non-HTTP schemes.
generatorURL payloads containing JavaScript comment sequences (//, /* */) adjacent to :// patterns.
Grafana audit logs showing alert creation by Editor-role accounts followed by anomalous API calls from higher-privileged sessions.

Detection Strategies

Inspect stored Alertmanager alerts for generatorURL values that do not begin with http:// or https://.
Review Grafana access logs for See source click events correlated with unexpected outbound API activity from the same browser session.
Alert on new alert submissions from accounts that historically do not create alerts, especially with unusually long or encoded generatorURL values.

Monitoring Recommendations

Forward Grafana application and audit logs to a centralized analytics platform and correlate alert creation with subsequent privileged API activity.
Monitor browser Content Security Policy (CSP) violation reports for inline script execution attempts on Grafana origins.
Track role changes and grants of the alert.instances.external:write scope to catch unauthorized permission expansion.

How to Mitigate CVE-2026-17033

Immediate Actions Required

Upgrade Grafana to the fixed version specified in the Grafana Security Advisory CVE-2026-17033.
Audit users assigned Editor role and the alert.instances.external:write permission and revoke access where not required.
Review existing Alertmanager alert records and purge entries containing non-HTTP schemes in generatorURL.

Patch Information

Grafana Labs has issued patched releases addressing CVE-2026-17033. The fix enforces URL-scheme validation on generatorURL rendering and replaces the substring-based click interceptor with a URL-parser-based safe-protocol allowlist. Refer to the vendor advisory for exact fixed version numbers and upgrade paths.

Workarounds

Restrict the alert.instances.external:write permission to trusted service accounts only.
Limit Editor role assignments and require multi-factor authentication for privileged Grafana accounts.
Deploy a strict Content Security Policy that disallows inline script execution and javascript: URLs on the Grafana origin.
Place Grafana behind a reverse proxy that inspects and rejects Alertmanager payloads containing non-HTTP schemes in generatorURL.

bash

# Example CSP header to block javascript: URL execution in Grafana responses
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";