Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Grafana v13.2.0 is out. - CVE-2026-17183 - Alerting: Add Import tab in alerting settings page #129051, @rodrigopk https://github.com/grafana/grafana/releases/tag/v13.2.0 #grafana #release #programming
Post summary
Grafana released v13.2.0 to address CVE-2026-17183, providing a fix via this update.