{"id":"CVE-2026-100105","kind":"vulnerability","aliases":["CVE-2026-100105"],"related":[],"title":"Grafana: contact point editors can redirect alerts and expose stored credentials","description":"A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).","summary":"A user allowed to edit contact points, but not their protected fields, can switch an integration to a legacy schema version and change protected settings such as the destination URL. This can expose stored credentials and send alert notifications to an attacker-chosen location.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grafana","fixed":["12.4.14","13.0.12","13.1.9","13.2.5","13.3.0"],"affected":"unknown lower bound, below fixed versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["alerting","grafana","other","rbac","self-hosted"],"not_affected_if":["no-contact-point-editors","single-admin"],"how_to_check":"Check the Grafana version (Help menu, or GET /api/health). If it is below the fixed version for your branch, you are exposed when non-admin users have alert contact point edit permission. Review contact points for integrations switched to a legacy (v0/mimir) version or changed destination URLs.","fix":"Upgrade to Grafana 12.4.14, 13.0.12, 13.1.9, 13.2.5 or 13.3.0 (whichever matches your branch). Until then, limit who holds contact point edit permission without protected-field rights.","status":"open","published_at":"2026-10-28T17:17:21+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:28+00:00","updated_at":"2026-10-28T17:39:20+00:00","category":"other","confidence":0.55,"triage":{"at":"2026-10-28T17:34:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: contact point editors can redirect alerts and expose stored credentials","impact":"high","summary":"A user allowed to edit contact points, but not their protected fields, can switch an integration to a legacy schema version and change protected settings such as the destination URL. This can expose stored credentials and send alert notifications to an attacker-chosen location.","category":"other","nicknames":[],"who_cares":["grafana","alerting"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker reads stored credentials and redirects alert notifications to their own server","analyst_note":"Check the NVD entry and Grafana's advisory for affected and fixed versions, and whether the legacy schema path is on by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":3286,"output_tokens":339,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Grafana's advisory for affected and fixed versions, and whether the legacy schema path is on by default.","search":"'-100105':14A,17A '-2026':13A,16A 'alert':7A,19B,63B,112C 'allow':28B 'attack':68B 'attacker-chosen':67B 'author':115C 'chang':48B,85C 'chosen':69B 'contact':2A,31B,77C,91C 'credenti':11A,60B,109C 'cve':12A,15A 'destin':54B,94C 'edit':30B,76C 'editor':4A 'expos':9A,58B,107C 'field':37B,83C 'grafana':1A,18A,20B 'host':25B 'incorrect':114C 'integr':41B,99C 'legaci':44B,102C 'locat':70B 'notif':64B,113C 'permiss':74C 'point':3A,32B,78C,92C 'protect':36B,49B,82C,86C 'rbac':22B 'redirect':6A,111C 'schema':45B,103C 'self':24B 'self-host':23B 'send':62B 'set':50B,87C 'store':10A,59B,108C 'switch':39B,97C 'url':55B,95C 'user':27B,72C 'version':46B,104C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Grafana instances (OSS and Enterprise) where some users can edit contact points but are denied the protected fields. They could switch an integration to a legacy schema version, change the destination URL and expose stored credentials. Instances where only admins edit contact points, or with no alerting users beyond admins, can skip the urgency. Grafana Cloud exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100105","severity":null,"published_at":"2026-10-28T17:17:21+00:00","modified_at":"2026-10-28T17:17:21+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-100105:973","url":null,"severity":null,"published_at":"2026-10-28T17:39:20+00:00","modified_at":"2026-10-28T17:39:20+00:00","first_seen_at":"2026-10-28T17:39:20+00:00","fetched_at":"2026-10-28T17:39:20+00:00","note":"Fixed versions read from Grafana's GitHub release notes (12.4.14, 13.0.12, 13.1.9, 13.2.5, 13.3.0, all 2026-10-27). No grafana.com advisory page found yet, so affected lower bounds, default-on status of the legacy path and PoC/exploitation are unknown. Nothing marked verified."}],"documents":[{"id":11645,"url":"https://github.com/grafana/grafana/releases/tag/v13.2.5","title":"Grafana 13.2.5 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":11646,"url":"https://github.com/grafana/grafana/releases","title":"Grafana releases (13.3.0, 13.2.5, 13.1.9, 13.0.12, 12.4.14)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}