CVE-2026-72585

Executive Summary

CVE-2026-72585 is an authorization bypass vulnerability in Grafana through version 13.2.0 that allows an authenticated user with the Editor role to delete protected contact points (notification receivers) without holding the required alert.notifications.receivers.protected:write permission. The flaw affects all Grafana installations where role-based access control (RBAC) and protected contact points are enabled, exposing organizations to disruption of alert notifications. With a CVSS score of 6.5, the vulnerability requires low-privilege authentication but no user interaction, and the integrity impact is high — an attacker can silently disable mission-critical alerting infrastructure.

Technical Analysis

The vulnerability resides in Grafana's role-based access control (RBAC) enforcement mechanism for alert notification receivers (contact points). In Grafana, contact points are the configured destinations for alert notifications (e.g., email, Slack, webhook endpoints). To prevent accidental or malicious deletion of critical receivers, Grafana introduced a "protected" flag for contact points. Deleting a protected contact point requires the explicit permission alert.notifications.receivers.protected:write.

The flaw is an authorization bypass in the permission-checking logic. An authenticated user with the Editor role — who normally holds the base permission alert.notifications.receivers:write but NOT the elevated alert.notifications.receivers.protected:write permission — is able to delete protected contact points. This indicates that the protected-contact-point deletion routine fails to properly enforce the elevated permission requirement, or that the authorization check is performed against an incorrect permission scope, allowing the standard write permission to satisfy the protected-write check.

The attack surface is the Grafana web API and UI endpoints responsible for managing alert notification receivers. The vulnerability is exploitable over the network with low attack complexity, requiring only valid Editor credentials. No user interaction is required. The CWE-284 classification (Improper Access Control) confirms that the issue is a failure to restrict access to a resource based on the correct authorization context.

The specific code-level details of the flawed authorization check are not available in the public advisory data. The vulnerable version range is identified as all Grafana versions through 13.2.0, with no patch yet released. The lack of patch coverage across all tracked sources (patch confidence 0/4) indicates that this is an actively unpatched vulnerability affecting current deployments.

Exploitation Scenarios

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification. An attacker first identifies a Grafana instance. This may be done via internet-wide scanning using search queries that fingerprint Grafana's HTTP interface (e.g., title tags, login page signatures). The attacker then needs valid credentials for an account with the Editor role. These may be obtained through credential stuffing, phishing, or legitimate access to a low-privilege account.

Step 2 — Flaw Trigger. Once authenticated as an Editor, the attacker navigates to the alerting configuration section of Grafana (the API endpoints managing contact points/receivers). The attacker identifies a protected contact point — one that is flagged as protected and should require the elevated alert.notifications.receivers.protected:write permission to delete.

Step 3 — Execution. The attacker sends a DELETE request to the contact point deletion endpoint for the protected receiver. Due to the authorization bypass, the server accepts the request despite the attacker lacking the required protected-write permission. The attacker does not need to craft a special payload — the flaw is in the server-side permission validation logic, not in input handling. The request is identical to a legitimate deletion request; only the permission requirements are not enforced properly.

Step 4 — Post-Exploitation Impact. Successful deletion of a protected contact point disables a critical alert notification channel. If the deleted receiver was the only route for critical alerts (e.g., on-call paging, security incident notifications), the organization loses visibility into security and operational incidents. The attacker can repeat this operation across multiple protected contact points, systematically dismantling the organization's alerting infrastructure. Because the attack changes integrity without affecting confidentiality or availability-of-service (the deletion is a discreet configuration change), it can go unnoticed for extended periods — alerts silently stop arriving.

The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N confirms: network-accessible, low complexity, low privileges required, no user interaction, and no scope change. The integrity impact is high, while confidentiality and availability impacts are none (in CVSS terms, availability here refers to service availability, not to alert reliability — although the operational availability impact of losing alerts is significant).

Impact Assessment

Business Impact. The primary impact is operational disruption of alerting and monitoring. Organizations rely on Grafana alerting to notify on-call engineers of service degradation, security incidents, and infrastructure failures. Removing protected contact points removes the notification pathway, causing alerts to be generated but never delivered. This creates a dangerous blind spot: incidents occur but no one is alerted. In security operations contexts, this could allow an active breach to proceed unnoticed.

CVSS Rationale. The high integrity score (I:H) reflects the complete compromise of configuration data integrity — the attacker can arbitrarily delete protected receivers without authorization. The low privilege requirement (PR:L) means a standard Editor account is sufficient. Network attack vector and no user interaction make this trivially exploitable once credentials are obtained.

Affected Systems and Blast Radius. All Grafana deployments running version 13.2.0 or earlier with RBAC enabled and protected contact points configured are potentially affected. The blast radius is limited to configurations where protected contact points exist; however, the feature is designed to protect the most critical notification channels, meaning the most security-sensitive targets are the ones at risk. Any organization using Grafana for security alerting, SOC operations, or critical infrastructure monitoring faces the highest impact.

Additive Risk. The vulnerability remains unpatched. There is no known public PoC or exploitation in the wild, but the attack mechanism is straightforward — it is a permission-check bypass that requires no special tooling beyond standard HTTP requests. The probability of exploitation increases over time as adversaries and security researchers identify the flaw.

Detection Guidance

Sigma Rule

title: Grafana Unauthorized Protected Contact Point Deletion
id: 7f9c3d2e-5a8b-4c6d-9e1f-0a2b3c4d5e6f
status: experimental
description: Detects attempts to delete protected contact points in Grafana by users lacking the required permission, indicative of CVE-2026-72585.
author: Valters IT Security Research
date: 2026/01/01
tags:
    - attack.defense_evasion
    - attack.t1548
    - cve.2026.72585
logsource:
    product: grafana
    service: server
detection:
    selection_domain:
        http.url|contains: /api/alertmanager/
        http.method: DELETE
    selection_route:
        http.url|contains:
            - /receivers/
            - /contact-points/
    selection_role:
        http.user_role: Editor
    condition: selection_domain and selection_route and selection_role
level: high
falsepositives:
    - Legitimate deletion of protected contact points by authorized users (these would require the protected:write permission)
    - API calls from integrations with Editor-level service accounts
    - Grafana versions where deletion logic is corrected
fields:
    - http.url
    - http.user_role
    - http.destination
    - source.ip

YARA Rule

rule grafana_cve_2026_72585_authz_bypass
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects Grafana API responses and logs indicating unauthorized deletion of protected contact points"
        cve = "CVE-2026-72585"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72585"
        severity = "high"
    strings:
        $s1 = "protected" ascii nocase
        $s2 = "contact point" ascii nocase
        $s3 = "receiver" ascii nocase
        $s4 = "grafana" ascii nocase
        $s5 = "DELETE" ascii
        $s6 = "Endpoint deleted" ascii nocase
        $s7 = "alert.notifications.receivers" ascii
    condition:
        (uint16(0) == 0x5B7B or uint16(0) == 0x3C21) and
        any of ($s*) and
        #s1 > 2
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Grafana CVE-2026-72585 - Unauthorized Protected Contact Point Deletion Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"/api/alertmanager/"; http.uri; content:"/receivers/"; http.uri; content:"/active"; offset:0; depth:20; reference:cve,2026-72585; classtype:attempted-admin; sid:202672585; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [any where event.action == "http_request" and
     url.path LIKE "/api/alertmanager/*receivers*" and
     http.request.method == "DELETE"]
  [any where event.action == "http_response" and
     http.response.status_code == 200 and
     http.response.body LIKE "*deleted*" and
     event.outcome == "success"]

Splunk SPL Query

index=web sourcetype=grafana_logs
  method=DELETE
  uri_path="/api/alertmanager/*"
  uri_path="*receivers*"
  | eval auth_role = if(match(role, "(?i)editor"), "editor", "unknown")
  | where auth_role=="editor"
  | stats count by src_ip, user, uri, status, _time
  | sort - _time
  | table _time, src_ip, user, uri, status, count
  | rename src_ip AS "Source IP", user AS "Authenticated User", uri AS "Request URI"

Wazuh OSSEC Rule

<group name="grafana,">
  <rule id="100501" level="10">
    <if_sid>100500</if_sid>
    <field name="http.method">"DELETE"</field>
    <field name="http.url">\./api/alertmanager/</field>
    <field name="http.url">\./receivers/</field>
    <description>Grafana: Potential unauthorized deletion of protected contact points (CVE-2026-72585)</description>
    <group>grafana_cve_2026_72585,</group>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source exists for this vulnerability. There is no vendor fix or version available that addresses CVE-2026-72585 at the time of writing.

1) Immediate Mitigations:

• Audit Editor-role accounts: Immediately review all accounts with the Editor role. Reduce the number of Editor-privilege accounts where possible, converting unused accounts to Viewer role. The fewer Editor accounts available, the smaller the attack surface.
• Monitor alert manager API activity: Enable detailed audit logging for all alerting and alertmanager API endpoints, particularly DELETE requests to receiver/contact point endpoints. Flag anomalies such as deletion requests from low-privilege roles.
• Segment network access: Restrict access to Grafana alert manager APIs to trusted networks and jump hosts using firewall rules or reverse-proxy ACLs. If possible, place Grafana instances behind a VPN or zero-trust access layer.
• Backup alert configurations: Maintain current backups of Grafana alerting configurations so that, if a protected contact point is deleted, it can be restored quickly. Reference the backup frequency to match expected alert configuration change cadence.
• Enable RBAC strictness: Review all current RBAC role assignments and ensure no custom roles inadvertently grant elevated permissions beyond their intended scope.

2) Patch/Upgrade Steps:

• Monitor vendor advisories: Actively track Grafana security bulletin channels (Grafana Security Advisories page and GitHub security advisories) for a patched release. Subscribe to release notifications for the stable channel.
• Plan immediate upgrade: When a patched version is released, develop and execute an upgrade plan immediately — within 24-48 hours of release — given the ease of exploitation of this flaw.
• Validate configuration after upgrade: After patching, verify that only users with alert.notifications.receivers.protected:write permission can delete protected contact points.

3) Long-Term Hardening:

• Principle of least privilege: Periodically audit all Grafana role assignments. Deprecate use of the built-in Editor role for operational teams when Viewer role suffices for their actual workflow needs.
• Multi-factor authentication: Enforce MFA for all Grafana accounts, especially those with Editor privileges, to reduce the likelihood of credential compromise leading to this vulnerability being exploited.
• Log retention and SIEM integration: Forward Grafana audit logs to a central SIEM with alerts on any abnormal alertmanager operations. Set up baseline behavior for alert configuration changes and alert on deviations.
• Security review of dashboards and alerting: Include alerting and notification configuration as part of periodic security reviews, confirming that protected contact points are appropriately flagged and that the protection mechanism functions as expected.
• Version hygiene: Maintain a defined patch cadence where Grafana upgrades happen within 14 days of any security-related release. Track all deployed Grafana versions in a configuration management database.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72585 — Official NVD CVE record containing the vulnerability description and CVSS scoring (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

2. Vendor Advisory — No vendor advisory has been published by Grafana for this CVE at the time of writing. Monitor https://grafana.com/security for updates.

3. CWE-284 Improper Access Control — https://cwe.mitre.org/data/definitions/284.html — MITRE Common Weakness Enumeration reference for the vulnerability class.

4. Grafana Security Advisories — https://grafana.com/security — Vendor's official security page where patch announcements will be published. Check this page periodically for remediation guidance.

5. CISA KEV — CVE-2026-72585 is NOT listed in the CISA Known Exploited Vulnerabilities catalog. No known exploitation in the wild has been reported at the time of this writing. No threat actor campaigns have been identified targeting this CVE.