CyberRota Analysis
AI-GeneratedGrafana OnCall versions up to 1.16.11 are vulnerable to unauthenticated access, allowing remote attackers to exploit hardcoded default values to obtain a valid PluginAuthToken. This critical vulnerability enables attackers to authenticate against internal APIs, create arbitrary Admin users, revoke legitimate tokens, and redirect API calls to malicious hosts. Organizations using Grafana OnCall should prioritize immediate remediation to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.