# CVE-2026-17033: CVE-2026-17033 CVE Record

> CVE-2026-17033: CVE-2026-17033 CVE Record. CVSS 6.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-17033
Last updated: 2026-10-12T15:10:00Z

- Published: 2026-08-24 13:52 UTC · Updated: 2026-10-12 15:10 UTC · Assigner: GRAFANA
- CVSS: 6.8 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
- EPSS: 0.22%, 12th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-79

## Description

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

## Affected vendors and products

- Grafana: Grafana OSS

## Tracked companies

- [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-17033)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-17033)
- [https://grafana.com/security/security-advisories/cve-2026-17033](https://grafana.com/security/security-advisories/cve-2026-17033)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-17033 · Markdown: https://rewindex.com/cve/CVE-2026-17033.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-17033 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:11.423Z