The flaw arises when Grafana renders the generatorURL field of an external Alertmanager alert without sanitizing the URL scheme. An attacker with Editor access or the alert.instances.external:write permission can create an alert containing a malicious generatorURL that embeds JavaScript. When a Grafana user with read permissions clicks the See source link, the browser loads the malicious JavaScript under Grafana’s origin, enabling the attacker to perform actions on behalf of that user. This is a classic reflected cross‑site scripting vulnerability classified as CWE‑79.

Grafana OSS is affected. No specific version numbers are listed in the advisory, so all installations of Grafana OSS that support external Alertmanager alerts are potentially vulnerable until a patch is applied.

With a CVSS score of 6.8 the vulnerability is considered medium severity. The exploit probability score is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires the attacker to be an authenticated user with specific permissions and a victim with read access to the alert. Once the victim clicks the link, malicious JavaScript runs with the victim’s privileges in the Grafana origin, which could lead to session hijacking or further credential compromise. Absence of an EPSS score indicates low publicly observed exploitation activity, but the medium CVSS highlights the potential damage to confidentiality, integrity, and availability of affected Grafana environments.