Cross-site scripting in Grafana - CVE-2026-17033
Published: August 25, 2026
Vulnerability identifier: #VU145350
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-17033
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's Grafana session.
The vulnerability exists due to improper neutralization of input during web page generation in the external Alertmanager alert generatorURL handling when rendering the Alert Details See source link. A remote user can submit an external Alertmanager alert containing a crafted generatorURL to execute arbitrary JavaScript in another user's Grafana session.
User interaction is required to click the See source link, and the script executes in the Grafana origin with the clicking user's permissions.
Affected software
Grafana
How to mitigate CVE-2026-17033
Install security update from vendor's website.
Grafana - update to 13.1.0