Threats Tagged 'cve-2026-17033'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to Grafana packages. The update addresses multiple security vulnerabilities, including CVE-2026-14199 and others, affecting Grafana versions 12.4.10-0.2.hum1 and 13.1.6-0.2.hum1 on aarch64 and x86_64 architectures. This update is a bug fix and enhancement release that resolves high severity issues.

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

CVE-2026-17033 is a cross-site scripting (XSS) vulnerability in Grafana OSS that allows an authenticated attacker with Editor access or alert.instances.external:write permission to inject malicious JavaScript via a crafted external Alertmanager alert. The vulnerability arises because Grafana renders the alert.generatorURL directly without proper URL-scheme sanitization or a safe-protocol allowlist. When a user with read access clicks the 'See source' link, the attacker's script executes in the context of the user's Grafana session.