CVE-2026-100105
Grafana alerting contact point authorization bypass via schema downgrade
A Grafana user who may edit contact points, but not their protected fields, can still change protected settings such as the destination URL. This can expose stored credentials and redirect alert notifications. Grafana rates it High, CVSS 7.7. Fixed on 27 October 2026 in 12.4.14, 13.0.12, 13.1.9 and 13.2.5. Public PoC since 31 October. Not in CISA KEV.
By ThreatWire Desk · Published 27 Oct 2026 · Updated 31 Oct 2026
- CVSS
- 7.7
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Class
- Auth bypass
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Grafana Labs
- Products
- Grafana OSS, Grafana Enterprise
- Affected
- Grafana 12.4.0 to 12.4.13, 13.0.0 to 13.0.11, 13.1.0 to 13.1.8 and 13.2.0 to 13.2.4. Versions older than 12.4.0 are not affected.
- Fixed
- Grafana 12.4.14, 13.0.12, 13.1.9 and 13.2.5, released 27 October 2026. 13.3.0 also lists the fix. No workaround published by Grafana.
- CWE
- CWE-863
- Published
- 27 Oct 2026
- Updated
- 31 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-100105 is an authorization flaw in Grafana Alerting. It affects Grafana OSS and Grafana Enterprise. The weakness is CWE-863, Incorrect Authorization.
Grafana separates who may edit a contact point from who may change its protected fields. Protected fields include the destination URL. A user with only the first permission can bypass that rule by switching an integration to a legacy schema version.
The result: stored credentials can leak, and alert notifications can go to an address the attacker chooses. The attacker needs a low-privileged account and network access to Grafana. No user interaction is needed.
Grafana rates it High, CVSS 3.1 7.7. Grafana is the CNA. NVD lists the CVE as Awaiting Analysis and has no score of its own.
Affected: 12.4.0 to 12.4.13, 13.0.0 to 13.0.11, 13.1.0 to 13.1.8 and 13.2.0 to 13.2.4. Versions older than 12.4.0 are not affected.
Fixed: 12.4.14, 13.0.12, 13.1.9 and 13.2.5, all released on 27 October 2026. 13.3.0 also lists the fix. Grafana has not published a workaround. The same release batch also fixed CVE-2026-88858, CVE-2026-88967 and CVE-2026-103506.
Timeline: Grafana published the advisory and fixes on 27 October. The CVE went public on CVE.org and NVD on 28 October. A public PoC repository appeared on 31 October.
PoC status: ThreatWire reviewed the PoC code but did not run it. It targets a local lab and shows the protected-field check being bypassed on a vulnerable version, and rejected on 13.2.5. We do not reprint any steps.
The CVE is not in the CISA KEV catalog (catalog 2026.10.30). ThreatWire found no report of exploitation in the wild.
What to do: upgrade to a fixed version. Until then, limit who can edit contact points and audit their destination URLs. Our explainer covers the checks.