PT-2026-3008 · Unknown+1 · Alertmanager+2

Published 2026-01-15 · Updated 2026-01-16 · CVE-2026-22641

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description A flaw exists in Grafana’s datasource proxy API that permits bypassing authorization checks. This is achieved by including an additional slash character within the URL path. Users with limited permissions may obtain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily impacts datasources utilizing route-specific permissions, such as Alertmanager and specific Prometheus-based datasources. The vulnerable component is the datasource proxy API. The affected API endpoints are GET endpoints in Alertmanager and Prometheus datasources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2026-00581

CVE-2026-22641

Affected Products

Alertmanager

Grafana

Prometheus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-22641 · Security Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00581 · Security Note
• https://sick.com/psirt · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://first.org/cvss/calculator/3.1 · Note
• https://twitter.com/CVEnew/status/2012303271810170904 · Twitter Post
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.json · Note