Grafana OnCall versions up to 1.16.11 contain an unauthenticated vulnerability that allows an attacker to obtain a valid PluginAuthToken by sending a‑coded stack_id and org_id values. This vulnerability is a CWE-306 (Authentication Bypass) weakness, where authentication checks are bypassed. With that token the attacker can authenticate to all internal API endpoints, create arbitrary administrative users, revoke legitimate plugin tokens, and overwrite the organization’s grafana_url and api_token to redirect API traffic to a malicious host. These capabilities effectively grant the attacker full administrative control over the OnCall instance, enabling them to execute arbitrary actions, manipulate configuration, and potentially exfiltrate data.

Grafana OnCall (grafana-cold-storage:oncall) versions 1.16.11 and earlier are impacted. The flaw resides in the internal plugin install endpoint.

The CVSS score of 9.3 indicates critical severity. An attacker can exploit this vulnerability without authentication by sending a POST request to the internal plugin install endpoint, requiring only network access to the affected instance. The EPSS score of <1% indicates a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. Despite the low EPSS, the lack of authentication and critical impact warrant close attention.