CVE-2026-72585 Overview
CVE-2026-72585 is an authorization bypass vulnerability in Grafana through version 13.2.0. An authenticated user holding the Editor role can delete protected contact points (alert receivers) without holding the required alert.notifications.receivers.protected:write permission. The flaw affects Grafana's alert notification provisioning subsystem, specifically the contact points management logic in pkg/services/ngalert/provisioning/contactpoints.go. Exploitation disrupts alerting workflows by removing receivers that route notifications to on-call teams, incident channels, or SIEM ingestion endpoints. The vulnerability is tracked under [CWE-284: Improper Access Control].
Critical Impact
An Editor-role user can silently remove protected alerting contact points, breaking incident notification pipelines and delaying detection of downstream security or availability events.
Affected Products
- Grafana versions through 13.2.0
- Grafana alert notification provisioning component (ngalert)
- Deployments using protected contact points for alert routing
Discovery Timeline
- 2026-08-10 - CVE-2026-72585 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-72585
Vulnerability Analysis
Grafana enforces a granular permission model for alerting resources. Contact points marked as protected require the alert.notifications.receivers.protected:write permission for modification or deletion. The delete flow in the contact points provisioning service fails to consistently validate this permission before executing the removal.
An Editor-role account, which normally holds general alert-editing capabilities but not the protected-receiver permission, can invoke the delete operation and succeed. The server accepts the request, removes the receiver, and confirms deletion. Downstream alert rules referencing that receiver stop delivering notifications.
The vulnerability affects integrity of alerting configuration. Attackers cannot read secret contents through this flaw, but they can disable notification paths that security teams rely on for detection.
Root Cause
The root cause is a missing authorization check within the contact points deletion path in pkg/services/ngalert/provisioning/contactpoints.go. The code validates general alerting permissions but does not verify the protected-receiver scope before allowing deletion. This is a classic broken access control pattern where a resource-level attribute (protected status) is not evaluated against the caller's specific permission set.
Attack Vector
An attacker requires network access to the Grafana instance and valid Editor-role credentials. The attack proceeds over the standard Grafana HTTP API. The attacker identifies a protected contact point, issues a DELETE request against its provisioning endpoint, and the server processes the request without enforcing the protected-write permission. No user interaction is required beyond the authenticated API call. Refer to the Grafana Security Advisory and the affected source in the Grafana contact points implementation for technical details.
Detection Methods for CVE-2026-72585
Indicators of Compromise
- Unexpected DELETE requests against /api/v1/provisioning/contact-points/{uid} endpoints from Editor-role accounts
- Grafana audit log entries showing contact point deletions not correlated with authorized change tickets
- Alert rules producing errors or silently failing to deliver notifications after configuration changes
- Sudden reduction in notification volume to SIEM, PagerDuty, Slack, or email receivers
Detection Strategies
- Enable Grafana audit logging and forward events to a centralized log platform for correlation with change management records
- Alert on any contact point deletion performed by non-administrator accounts
- Baseline the expected inventory of protected contact points and detect drift through periodic API inventory snapshots
Monitoring Recommendations
- Monitor authentication and role assignment changes in Grafana to identify Editor accounts that could exercise the flaw
- Track alert notification delivery health end-to-end so silent receiver deletions surface as delivery gaps
- Review Grafana access logs for API calls to /api/v1/provisioning/contact-points from non-admin users
How to Mitigate CVE-2026-72585
Immediate Actions Required
- Upgrade Grafana to a version later than 13.2.0 that contains the fix for CVE-2026-72585
- Audit current Editor-role assignments and revoke access from accounts that do not require alert configuration privileges
- Review recent contact point deletions and restore any receivers removed without authorization
Patch Information
Grafana Labs has addressed the missing authorization check in the contact points provisioning code path. Consult the Grafana Security Advisory for the exact fixed versions and upgrade instructions. Deployments running Grafana through 13.2.0 should apply the vendor-supplied update.
Workarounds
- Restrict the Editor role assignment to a minimal, trusted set of users until patching completes
- Use Grafana's role-based access control to move alert notification management to a dedicated administrative role
- Implement infrastructure-as-code reconciliation (for example, Terraform or Grafana provisioning files) to automatically restore deleted contact points
- Place Grafana behind an authenticated reverse proxy that logs and can block DELETE requests to provisioning endpoints from non-approved identities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
