SB20260825111 - Cross-site scripting in Grafana

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260825111

SB20260825111 - Cross-site scripting in Grafana

Published: August 25, 2026

Security Bulletin ID SB20260825111
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-17033)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's Grafana session.

The vulnerability exists due to improper neutralization of input during web page generation in the external Alertmanager alert generatorURL handling when rendering the Alert Details See source link. A remote user can submit an external Alertmanager alert containing a crafted generatorURL to execute arbitrary JavaScript in another user's Grafana session.

User interaction is required to click the See source link, and the script executes in the Grafana origin with the clicking user's permissions.


Remediation

Install update from vendor's website.

References