CVE-2026-63087: Missing Authentication for Critical Function in grafana-cold-storage oncall
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.
AI Analysis
Technical Summary
CVE-2026-63087 affects Grafana OnCall through version 1.16.11 and involves missing authentication for a critical function in the grafana-cold-storage oncall plugin. Remote attackers can send a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values found in the public source tree to obtain a valid PluginAuthToken without authentication. With this token, attackers can authenticate to all internal API endpoints, create arbitrary admin users via the user-context header bootstrap path, revoke legitimate plugin tokens, and redirect OnCall-to-Grafana API calls by overwriting the organization's grafana_url and api_token. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows remote attackers to fully compromise the Grafana OnCall instance by authenticating to internal APIs without credentials. They can create admin users, revoke legitimate tokens, and redirect API calls to attacker-controlled hosts, potentially leading to complete system takeover, data manipulation, and disruption of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the internal plugin install endpoint and audit usage of default stack_id and org_id values. Monitor for suspicious POST requests targeting the plugin install endpoint. Avoid using versions up to 1.16.11 in production environments if possible.
CVE-2026-63087: Missing Authentication for Critical Function in grafana-cold-storage oncall
Description
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63087 affects Grafana OnCall through version 1.16.11 and involves missing authentication for a critical function in the grafana-cold-storage oncall plugin. Remote attackers can send a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values found in the public source tree to obtain a valid PluginAuthToken without authentication. With this token, attackers can authenticate to all internal API endpoints, create arbitrary admin users via the user-context header bootstrap path, revoke legitimate plugin tokens, and redirect OnCall-to-Grafana API calls by overwriting the organization's grafana_url and api_token. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows remote attackers to fully compromise the Grafana OnCall instance by authenticating to internal APIs without credentials. They can create admin users, revoke legitimate tokens, and redirect API calls to attacker-controlled hosts, potentially leading to complete system takeover, data manipulation, and disruption of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the internal plugin install endpoint and audit usage of default stack_id and org_id values. Monitor for suspicious POST requests targeting the plugin install endpoint. Avoid using versions up to 1.16.11 in production environments if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-15T15:45:44.600Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5907d068715ace4356cd1d
Added to database: 07/16/2026, 16:33:20 UTC
Last enriched: 07/23/2026, 21:25:16 UTC
Last updated: 08/30/2026, 22:52:13 UTC
Views: 156
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.