CVE-2025-12141

The record

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.

Affected packages

Related vulnerabilities

• CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects grafana
• CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
• CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects grafana
• CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Also affects grafana
• CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation… Also affects grafana
• CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. Also affects grafana
• CVE-2026-33380 A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary… Also affects grafana
• CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific… Also affects grafana