Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-16 | 4 | Disclosure2General1Patch1 |
| 2026-07-17 | 1 | Disclosure1 |
| 2026-07-19 | 1 | General1 |
1/8 CVE-2026-63087 is a live 9.8 in Grafana OnCall self-hosted. The project was archived on June 5, 2026. That makes this one literal: affected installs have an unauthenticated auth bypass, and no upstream patch is coming.
Post summary
CVE‑2026‑63087 is a critical unauthenticated authentication bypass in Grafana OnCall self‑hosted, with the project archived and no patch expected.
🚨 CVE-2026-63087 — CVSS 9.8/10 ██████████ Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/pfOHuQuGCf
Post summary
The tweet announces a critical CVE-2026-63087 in Grafana OnCall with unauthenticated access vulnerability, provides a CVSS score, and states a patch is available.
IT Tech Tracker: hoy destaca en SECURITY: "CVE-2026-63087: Grafana Oncall is EOL". Más detalles: https://www.reddit.com/r/devops/comments/1v07ef4/cve202663087_grafana_oncall_is_eol/ #IT #Tecnología
Post summary
El mensaje simplemente referencia el CVE-2026-63087 y declara que Grafana Oncall está EOL, sin proporcionar detalles técnicos, exploit, parche u ocurrencia de explotación en la práctica.
🚨 Critical Grafana OnCall Auth Bypass (CVE-2026-63087, CVSS 9.8) Unauth attackers can get PluginAuthToken, create Admins, and takeover the platform. Upgrade now (beyond 1.16.11). 🔗 https://threataft.com/articles/grafana-oncall-authentication-bypass-cve-2026-63087?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel
Post summary
The tweet announces a critical Authentication Bypass vulnerability in Grafana OnCall (CVE‑2026‑63087) with a CVSS 9.8 score, urging users to upgrade beyond 1.16.11, and links to an article that likely contains further details.
NVD status: Awaiting enrichment. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-63087
Post summary
The snippet only states that NVD is awaiting enrichment for CVE‑2026‑63087, providing no additional detail about the vulnerability.
🚨Critical - Grafana OnCall Unauthenticated Token Hijack (CVE-2026-63087) Grafana OnCall through 1.16.11 exposes an internal plugin-install endpoint that accepts an unauthenticated POST using hardcoded default stack_id and org_id values found in the public source tree. This lets a remote attacker obtain a valid PluginAuthToken with no credentials. With that token, an attacker can authenticate to all internal API endpoints, create arbitrary Admin users, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API traffic to an attacker-controlled host by overwriting grafana_url and api_token. CVSS 9.3. Note: Grafana OnCall is deprecated and marked Unsupported When Assigned, so no patch is expected. 👉Affected: Grafana OnCall <= 1.16.11. Migrate off Grafana OnCall OSS and restrict network access to any remaining instances.
Post summary
Grafana OnCall versions up to 1.16.11 allow unauthenticated token hijack, enabling full API access and admin control; no patch exists, so users should migrate off or isolate the service.