---
id: "CVE-2026-100105"
kind: "vulnerability"
aliases: ["CVE-2026-100105"]
title: "Grafana: contact point editors can redirect alerts and expose stored credentials"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "grafana", "fixed": ["12.4.14", "13.0.12", "13.1.9", "13.2.5", "13.3.0"], "affected": "unknown lower bound, below fixed versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["alerting", "grafana", "other", "rbac", "self-hosted"]
not_affected_if: ["no-contact-point-editors", "single-admin"]
published_at: "2026-10-28T17:17:21+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:39:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100105", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:39:20+00:00"}]
---

# Grafana: contact point editors can redirect alerts and expose stored credentials

A user allowed to edit contact points, but not their protected fields, can switch an integration to a legacy schema version and change protected settings such as the destination URL. This can expose stored credentials and send alert notifications to an attacker-chosen location.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:grafana affected unknown lower bound, below fixed versions fixed 12.4.14, 13.0.12, 13.1.9, 13.2.5, 13.3.0

## How to check

Check the Grafana version (Help menu, or GET /api/health). If it is below the fixed version for your branch, you are exposed when non-admin users have alert contact point edit permission. Review contact points for integrations switched to a legacy (v0/mimir) version or changed destination URLs.

## Fix

Upgrade to Grafana 12.4.14, 13.0.12, 13.1.9, 13.2.5 or 13.3.0 (whichever matches your branch). Until then, limit who holds contact point edit permission without protected-field rights.

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100105
- 2026-10-28T17:39:20+00:00 analyst — Fixed versions read from Grafana's GitHub release notes (12.4.14, 13.0.12, 13.1.9, 13.2.5, 13.3.0, all 2026-10-27). No grafana.com advisory page found yet, so affected lower bounds, default-on status of the legacy path and PoC/exploitation are unknown. Nothing marked verified.

## Documents

- [fix] Grafana 13.2.5 release notes https://github.com/grafana/grafana/releases/tag/v13.2.5
- [fix] Grafana releases (13.3.0, 13.2.5, 13.1.9, 13.0.12, 12.4.14) https://github.com/grafana/grafana/releases

## From the sources

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_