CVE-2022-31097: Grafana Unified Alerting stored XSS allows editor-to-admin privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.7 with scope change and high confidentiality and integrity impact, plus a very high EPSS score, though exploitation requires an authenticated editor and admin user interaction.

What it is

Grafana 8.x and 9.x branches before 9.0.3, 8.5.9, 8.4.10 and 8.3.10 contain a stored cross-site scripting flaw in the Unified Alerting feature. An attacker with editor privileges can store malicious content that executes in an authenticated admin's browser, escalating their own access to admin. The issue is patched in the listed versions, and disabling alerting or using legacy alerting is a documented workaround.

Impact

An attacker gains administrative control of the Grafana instance, which can expose dashboards, data sources and credentials and allow further configuration changes. The CVSS vector rates confidentiality and integrity impact as high with no availability impact.

Attack surface

Reached over the network through the Unified Alerting feature; the attacker needs an authenticated editor account and the victim admin must click a crafted link (UI:R). No unauthenticated path is described.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.686 probability, 99.3rd percentile), indicating elevated likelihood of exploitation. References are release notes and vendor/third-party advisories only, with no public exploit tag.

What to do

• Upgrade Grafana to 9.0.3, 8.5.9, 8.4.10 or 8.3.10 (or later) as the primary fix.
• If immediate patching is not possible, disable alerting or switch to legacy alerting as the vendor-documented workaround.
• Restrict editor accounts to trusted users and review who holds editor privileges.
• Apply the NetApp advisory guidance for E-Series Performance Analyzer deployments that bundle affected Grafana versions.
• Monitor Grafana release notes for follow-up fixes on the 8.x and 9.x branches.

Detection

• Review Grafana audit and application logs for alert rule or alerting configuration changes made by editor accounts.
• Hunt for suspicious script content or unexpected HTML in stored alert definitions and notification templates.
• Monitor admin sessions for privilege or role changes originating shortly after an admin clicks an external link.
• Alert on Grafana versions below 9.0.3, 8.5.9, 8.4.10 or 8.3.10 in asset inventories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.