Grafana alerting flaw lets Editors expose contact point credentials, PoC now public

Timing: Grafana shipped the fix on 27 October 2026. The CVE went public on CVE.org and NVD on 28 October. A public PoC appeared on 31 October. We publish the same day, four days after the patch.

What happened

A flaw in Grafana Alerting lets low-privileged users expose credentials stored in contact points and redirect alert notifications. It is tracked as CVE-2026-100105.

Contact points are where Grafana sends alerts, such as a webhook or a chat integration. Some of their fields are protected, like the destination URL. Grafana lets admins grant edit access to a contact point without access to those fields.

The advisory says a user with only edit access can still change protected settings. They do it by switching an integration to a legacy schema version. Grafana classes it as incorrect authorization (CWE-863).

Who is affected

The flaw affects Grafana OSS and Grafana Enterprise. Affected versions:

• 12.4.x: 12.4.0 to 12.4.13
• 13.0.x: 13.0.0 to 13.0.11
• 13.1.x: 13.1.0 to 13.1.8
• 13.2.x: 13.2.0 to 13.2.4

Versions older than 12.4.0 are not affected. The attacker needs an account that can edit contact points. In the PoC lab, that was a standard Editor. Grafana has not published a statement about Grafana Cloud for this CVE.

What is confirmed

• The fix. Grafana 12.4.14, 13.0.12, 13.1.9 and 13.2.5, released on 27 October. 13.3.0 also lists the fix.
• The score. Grafana rates it High, CVSS 3.1 7.7. Grafana is the CNA. NVD has not scored it yet.
• The impact. Stored credentials can leak. Alerts can be sent to an attacker-controlled destination.
• A public PoC. A GitHub repository published on 31 October targets this CVE. ThreatWire reviewed its code but did not run it. It uses a local lab with official Grafana images. It shows the edit being refused, then accepted after the schema switch. On 13.2.5 the change is rejected. We do not reprint any steps.
• Same release batch. The same releases also fixed CVE-2026-88858, CVE-2026-88967 and CVE-2026-103506.

What is not confirmed

• No exploitation in the wild. We found no report of attacks.
• Not in CISA KEV. We checked catalog 2026.10.30 on 31 October.
• No independent reproduction. ThreatWire did not execute the PoC.
• No workaround from Grafana. The advisory lists only fixed versions.
• No credit. Grafana does not name a reporter.

What to do

1. Upgrade now to 12.4.14, 13.0.12, 13.1.9 or 13.2.5. This is Grafana's fix.
2. Limit contact point editors until you patch. Review who holds Editor or alerting write roles. (ThreatWire advice.)
3. Audit contact points. Check destination URLs and webhook or receiver settings for changes you did not make. (ThreatWire advice.)
4. Rotate stored secrets if low-privileged users had edit access. That covers tokens, passwords and webhook keys in contact points. (ThreatWire advice.)
5. Review logs. Look for contact point updates in Grafana audit or server logs. (ThreatWire advice.)

Sources

Record: CVE-2026-100105.

Sources: Grafana security advisory, Grafana v13.2.5 release notes, CVE.org, NVD, GitHub Advisory Database and the CISA KEV catalog. Links are in the references list.