Bug 2521910 (CVE-2026-17033)

Summary: CVE-2026-17033 grafana: Grafana: Cross-Site Scripting (XSS) via unsanitized Alertmanager generatorURL
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Grafana. An authenticated attacker with Editor access or `alert.instances.external:write` permissions can submit an external Alertmanager alert containing a controlled `generatorURL`. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the click interceptor's security heuristic. This can lead to a Cross-Site Scripting (XSS) vulnerability, where a user with read access who clicks the 'See source' link will execute attacker-controlled JavaScript in their browser with the permissions of the clicking user, potentially leading to information disclosure or unauthorized actions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2559100, 2559102, 2559104    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-24 14:02:50 UTC 
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.

Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.