CVE-2026-17033

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. The software renders alert.generatorURL directly as the href of the See source LinkButton without proper URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. Consequently, when a user with read access clicks the See source link, the browser executes attacker-controlled JavaScript within the Grafana origin using the permissions of the clicking user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.