Grafana Enterprise (< 12.4.14, 13.0.12, 13.1.9, 13.2.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/grafana-enterprise--12.4.14-13.0.12-13.1.9-13.2.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 10:15:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrafana Alerting: Authorization bypass via schema downgrade (CVE-2026-100105)https://feed.craftedsignal.io/briefs/2026-10-grafana-auth-bypass/Sat, 31 Oct 2026 10:15:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-grafana-auth-bypass/CVE-2026-100105 is an authorization bypass in Grafana Alerting Contact Points that allows attackers with Editor permissions to redirect alert notifications to unauthorized destinations and exfiltrate credentials through schema version manipulation.CVE-2026-100105 (GHSA-92gx-p2qg-82fw) is a high-severity authorization bypass vulnerability in Grafana OSS and Enterprise versions 12.4.x, 13.0.x, 13.1.x, and 13.2.0 - 13.2.4. The vulnerability arises because sensitive fields in alert notification integrations (such as the webhook destination URL) are protected by RBAC logic that validates configuration changes against a schema. By switching an integration to a legacy schema version (v0mimir1), the protection logic is bypassed because the URL field is not marked as protected in the legacy schema definition.

A researcher also identified two additional authorization weaknesses (Zero-day findings A and B) that remain reproducible on the fully patched version 13.2.5. These affect the ReceiverTestingService subresource, allowing attackers to exfiltrate stored credentials (e.g., Basic Auth headers) and dispatch notifications to unauthorized URLs without requiring persistent modification to stored receivers.

Attack Chain

  1. Attacker (with Editor role) enumerates existing alert receivers via GET /apis/notifications.alerting.grafana.app/v1beta1/namespaces/default/receivers.
  2. Attacker selects a target receiver and prepares a PUT request to update its configuration.
  3. Attacker embeds a schema downgrade in the request by setting the integration version to a legacy identifier (e.g., v0mimir1).
  4. Attacker includes an arbitrary attacker-controlled destination URL in the settings object.
  5. The Grafana backend evaluates the protected-field diff against the legacy schema version, which fails to trigger the authorization check.
  6. The system updates the stored receiver configuration with the attacker's malicious destination URL.
  7. Attacker triggers a notification (via the test subresource or actual alert firing) to exfiltrate alert payloads or stored credentials to their infrastructure.

Impact

Successful exploitation allows for the silent exfiltration of alert payloads and sensitive notification credentials (e.g., tokens, API keys, Basic Auth credentials) to attacker-controlled infrastructure. This risk persists after patching for receivers that were already downgraded while the instance was unpatched.

Recommendation

  • Upgrade to Grafana OSS or Enterprise versions 12.4.14, 13.0.12, 13.1.9, or 13.2.5 immediately.
  • After upgrading, audit all existing alert receivers for legacy or non-standard schema versions (version != "v1" for webhooks) and verify that their destination URLs are legitimate.
  • Monitor logs for unusual sequences of PUT requests to receiver configuration endpoints followed by POST requests to receiver-test subresources from non-administrative users.
]]>highadvisory