---
id: CVE-2026-17033
title: >-
  An authenticated attacker with Editor access or alert.instances.external:write
  can submit an external Alertmanager alert containing a controlled generatorURL
summary: >-
  An authenticated attacker with Editor access or alert.instances.external:write
  can submit an external Alertmanager alert containing a controlled
  generatorURL. The attacker is authorized to create the alert, but not to
  execute script in a…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L'
cwe:
  - CWE-79
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17033'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-17033'
    label: security@grafana.com
tags:
  - nvd
epss: 0.00218
epssPercentile: 0.11279
ingestedAt: '2026-10-12T15:55:08.116Z'
---

## Overview

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.

Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.