Live › vulnerability › CVE-2026-100105
Go to dashboardA user allowed to edit contact points, but not their protected fields, can switch an integration to a legacy schema version and change protected settings such as the destination URL. This can expose stored credentials and send alert notifications to an attacker-chosen location.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Self-hosted Grafana instances (OSS and Enterprise) where some users can edit contact points but are denied the protected fields. They could switch an integration to a legacy schema version, change the destination URL and expose stored credentials. Instances where only admins edit contact points, or with no alerting users beyond admins, can skip the urgency. Grafana Cloud exposure is unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| grafana | vendor | unknown lower bound, below fixed versions | 12.4.14, 13.0.12, 13.1.9, 13.2.5, 13.3.0 |
12.4.14, 13.0.12, 13.1.9, 13.2.5 or 13.3.0 (whichever matches your branch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
This page as .md · .json · in your agent: get_signal("CVE-2026-100105")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.