{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grafana-enterprise--12.4.14-13.0.12-13.1.9-13.2.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-100105"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grafana OSS (\u003c 12.4.14, 13.0.12, 13.1.9, 13.2.5)","Grafana Enterprise (\u003c 12.4.14, 13.0.12, 13.1.9, 13.2.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Grafana"],"content_html":"\u003cp\u003eCVE-2026-100105 (GHSA-92gx-p2qg-82fw) is a high-severity authorization bypass vulnerability in Grafana OSS and Enterprise versions 12.4.x, 13.0.x, 13.1.x, and 13.2.0 - 13.2.4. The vulnerability arises because sensitive fields in alert notification integrations (such as the webhook destination URL) are protected by RBAC logic that validates configuration changes against a schema. By switching an integration to a legacy schema version (\u003ccode\u003ev0mimir1\u003c/code\u003e), the protection logic is bypassed because the URL field is not marked as protected in the legacy schema definition.\u003c/p\u003e\n\u003cp\u003eA researcher also identified two additional authorization weaknesses (Zero-day findings A and B) that remain reproducible on the fully patched version 13.2.5. These affect the \u003ccode\u003eReceiverTestingService\u003c/code\u003e subresource, allowing attackers to exfiltrate stored credentials (e.g., Basic Auth headers) and dispatch notifications to unauthorized URLs without requiring persistent modification to stored receivers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker (with Editor role) enumerates existing alert receivers via GET /apis/notifications.alerting.grafana.app/v1beta1/namespaces/default/receivers.\u003c/li\u003e\n\u003cli\u003eAttacker selects a target receiver and prepares a PUT request to update its configuration.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a schema downgrade in the request by setting the integration version to a legacy identifier (e.g., v0mimir1).\u003c/li\u003e\n\u003cli\u003eAttacker includes an arbitrary attacker-controlled destination URL in the settings object.\u003c/li\u003e\n\u003cli\u003eThe Grafana backend evaluates the protected-field diff against the legacy schema version, which fails to trigger the authorization check.\u003c/li\u003e\n\u003cli\u003eThe system updates the stored receiver configuration with the attacker's malicious destination URL.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a notification (via the test subresource or actual alert firing) to exfiltrate alert payloads or stored credentials to their infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the silent exfiltration of alert payloads and sensitive notification credentials (e.g., tokens, API keys, Basic Auth credentials) to attacker-controlled infrastructure. This risk persists after patching for receivers that were already downgraded while the instance was unpatched.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Grafana OSS or Enterprise versions 12.4.14, 13.0.12, 13.1.9, or 13.2.5 immediately.\u003c/li\u003e\n\u003cli\u003eAfter upgrading, audit all existing alert receivers for legacy or non-standard schema versions (\u003ccode\u003eversion != \u0026quot;v1\u0026quot;\u003c/code\u003e for webhooks) and verify that their destination URLs are legitimate.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual sequences of \u003ccode\u003ePUT\u003c/code\u003e requests to receiver configuration endpoints followed by \u003ccode\u003ePOST\u003c/code\u003e requests to receiver-test subresources from non-administrative users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T10:15:50Z","date_published":"2026-10-31T10:15:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grafana-auth-bypass/","summary":"CVE-2026-100105 is an authorization bypass in Grafana Alerting Contact Points that allows attackers with Editor permissions to redirect alert notifications to unauthorized destinations and exfiltrate credentials through schema version manipulation.","title":"Grafana Alerting: Authorization bypass via schema downgrade (CVE-2026-100105)","url":"https://feed.craftedsignal.io/briefs/2026-10-grafana-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Grafana Enterprise (\u003c 12.4.14, 13.0.12, 13.1.9, 13.2.5)","version":"https://jsonfeed.org/version/1.1"}