Grafana Alerting Editors can edit destination of webhooks they did not create

The primary impact of CVE-2025-12141 is the potential exposure of sensitive authentication credentials used by Grafana Alerting to interact with external services. An attacker could modify a contact point's endpoint URL to point to a server they control. By triggering the test functionality of the contact point, the attacker can then capture the redacted secure settings, including tokens, API keys, or passwords. Successful exploitation could lead to unauthorized access to the targeted third-party services, such as Slack, PagerDuty, or email providers. This could result in data breaches, unauthorized actions within those services, and potential lateral movement within the affected organization.

Organizations using Grafana Alerting with a large number of users who have 'Editor' or 'Contact Point Writer' roles are particularly at risk. Shared hosting environments where multiple users share access to Grafana Alerting instances are also vulnerable, as an attacker could potentially compromise the entire environment through a single user account. Legacy Grafana Alerting deployments that have not been regularly updated are also at increased risk.

• grafana: Examine Grafana Alerting logs for requests to unexpected or suspicious endpoints.

grep 'test_notification_url' /var/log/grafana/alerting.log

• linux / server: Monitor system logs for unusual network connections originating from the Grafana Alerting process.

journalctl -u grafana --grep 'test_notification_url'

• generic web: Use curl to check for the existence of potentially malicious endpoints.

curl -I https://<grafana_url>/plugin/alerting/contact-points/test

1. 2026-04-15Disclosure

   disclosure

2. 2026-04-15Patch

   patch

1. Reserviert2025-10-24
2. Veröffentlicht2026-04-15
3. EPSS aktualisiert2026-04-23

The primary mitigation for CVE-2025-12141 is to upgrade Grafana Alerting to version 12.3.1 or later. Prior to upgrading, review existing contact point configurations to identify any suspicious or unauthorized modifications. Implement strict access controls to limit the number of users with 'alert.notifications:write' or 'alert.notifications.receivers:test' permissions. Consider using a Web Application Firewall (WAF) to filter requests to the alerting endpoint and block suspicious patterns. Monitor Grafana Alerting logs for any unusual activity related to contact point testing or modifications. After upgrading, confirm the fix by attempting to modify a contact point and verifying that the test functionality no longer exposes sensitive credentials.