All vulnerabilities
CVE-2026-100105

Grafana Enterprise: Alerting contact point authorization bypass via schema downgrade

Grafana Grafana EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

Text from CVE List

Affected versions 8

  • Grafana Enterpriseaffected: 12.4.0 through 12.4.13CVE List
  • Grafana Enterpriseaffected: 13.0.0 through 13.0.11CVE List
  • Grafana Enterpriseaffected: 13.1.0 through 13.1.8CVE List
  • Grafana Enterpriseaffected: 13.2.0 through 13.2.4CVE List
  • Grafana OSSaffected: 12.4.0 through 12.4.13CVE List
  • Grafana OSSaffected: 13.0.0 through 13.0.11CVE List
  • Grafana OSSaffected: 13.1.0 through 13.1.8CVE List
  • Grafana OSSaffected: 13.2.0 through 13.2.4CVE List

References 1