CVE-2026-63087
Grafana OnCall versions up to 1.16.11 contain an unauthenticated access flaw. Remote attackers can send a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values to obtain a valid PluginAuthToken. With this token they can authenticate to internal APIs, create admin users, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Grafana OnCall through version 1.16.11
Real-world impact
Attackers can gain full administrative control over the OnCall instance and manipulate its integration with Grafana.
Why this severity
CVSS v4.0 base score 9.3 (Critical) reflects network‑adjacent, low‑complexity attack with no privileges or user interaction required, leading to high impacts on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources