CVE-2026-63087 is a critical vulnerability in Grafana OnCall (grafana-cold-storage) through version 1.16.11. It arises from missing authentication on a critical internal plugin install endpoint. The endpoint uses hardcoded default stack_id and org_id values visible in the public source tree, allowing remote attackers to send unauthenticated POST requests to obtain a valid PluginAuthToken. With this token, attackers can authenticate to all internal API endpoints, create arbitrary admin users via the user-context header bootstrap path, revoke legitimate plugin tokens, and redirect OnCall-to-Grafana API calls by overwriting organization configuration such as grafana_url and api_token. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to fully compromise the Grafana OnCall internal API, including creating admin users, revoking legitimate tokens, and redirecting API calls to attacker-controlled hosts. This leads to complete loss of confidentiality, integrity, and availability of the affected system's internal API functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict network access to the internal plugin install endpoint and monitor for suspicious POST requests targeting this endpoint. Avoid using default or hardcoded stack_id and org_id values in production deployments.