Grafana Labs 10.4.x < 10.4.15 / 11.0.x < 11.0.11 / 11.1.x < 11...

CVE-2024-11741 is an authorization bypass in Grafana's Alerting module, specifically in the VictorOps (now Splunk On-Call) contact-point integration. Users authenticated with only Viewer permissions can read configuration data for the VictorOps integration — including the API key, routing key, and webhook URL — that should be restricted to Editor and Admin roles. The flaw affects a wide span of Grafana releases: 10.4.x < 10.4.15, 11.0.x < 11.0.11, 11.1.x < 11.1.11, 11.2.x < 11.2.6, 11.3.x < 11.3.3, and 11.4.x < 11.4.1. It is fixed in those respective patch versions and in 11.5.0+.

Grafana Labs rated this MEDIUM (4.3), and for once, even that feels generous. The CVSS vector shows C:L/I:N/A:N — low confidentiality impact, zero integrity, zero availability. The leaked data is an API key for a *third-party incident-management webhook*, not Grafana datasource credentials, database connection strings, or dashboard data. The worst realistic outcome is an attacker injecting fake alerts into your Splunk On-Call pipeline — annoying, not catastrophic. Tenable's own VPR score of 1.2 (0.01 percentile) agrees this is noise. Add the fact that VictorOps is an increasingly niche integration — Splunk On-Call's future is uncertain under Cisco ownership — and the affected population shrinks further. The vendor severity overstates the real-world risk.

1. Rotate VictorOps/Splunk On-Call API keys immediately — If you have the VictorOps contact point configured in Grafana, rotate the API key and routing key in Splunk On-Call and update the Grafana contact point. This neutralizes any previously leaked credentials. No noisgate mitigation SLA applies for LOW-severity findings — treat this as backlog hygiene.
2. Audit Grafana Viewer accounts — Review all accounts with Viewer role. Remove any stale, orphaned, or contractor accounts that no longer need access. This reduces the pool of users who could exploit the authorization bypass.
3. Enable Grafana Enterprise audit logging — If running Grafana Enterprise, enable audit logging for API access to contact-point endpoints. This provides detection coverage for any unauthorized reads of integration configuration. In OSS Grafana, configure reverse-proxy access logging to capture API calls.
4. Patch to fixed version within 365 days (noisgate remediation SLA) — Upgrade to Grafana 10.4.15, 11.0.11, 11.1.11, 11.2.6, 11.3.3, 11.4.1, or 11.5.0+ during your next regular patching cycle. For a LOW-severity finding, there is no noisgate mitigation SLA — go straight to the 365-day remediation window.

Run this script on any host that can reach the Grafana HTTP API. Pass the Grafana base URL as the first argument. Requires curl and jq. No special Grafana privileges needed — it checks the running version against the fixed version list. Example: bash check_cve_2024_11741.sh https://grafana.internal:3000

#!/usr/bin/env bash
# check_cve_2024_11741.sh — Version check for CVE-2024-11741
# Grafana Alerting VictorOps info disclosure
# Usage: bash check_cve_2024_11741.sh <GRAFANA_URL>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:?Usage: $0 <GRAFANA_URL>}"
GRAFANA_URL="${GRAFANA_URL%/}"

# Fetch version from health endpoint (unauthenticated)
VERSION=$(curl -sf "${GRAFANA_URL}/api/health" 2>/dev/null | jq -r '.version // empty' 2>/dev/null)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not retrieve Grafana version from ${GRAFANA_URL}/api/health"
  exit 2
fi

echo "Detected Grafana version: $VERSION"

# Compare versions using sort -V
version_gte() {
  # Returns 0 if $1 >= $2
  [[ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" == "$2" ]]
}

# Extract major.minor
MAJOR_MINOR=$(echo "$VERSION" | grep -oP '^\d+\.\d+')

case "$MAJOR_MINOR" in
  10.4)
    if version_gte "$VERSION" "10.4.15"; then
      echo "PATCHED — $VERSION >= 10.4.15"
      exit 0
    else
      echo "VULNERABLE — $VERSION < 10.4.15 (CVE-2024-11741)"
      exit 1
    fi
    ;;
  11.0)
    if version_gte "$VERSION" "11.0.11"; then
      echo "PATCHED — $VERSION >= 11.0.11"
      exit 0
    else
      echo "VULNERABLE — $VERSION < 11.0.11 (CVE-2024-11741)"
      exit 1
    fi
    ;;
  11.1)
    if version_gte "$VERSION" "11.1.11"; then
      echo "PATCHED — $VERSION >= 11.1.11"
      exit 0
    else
      echo "VULNERABLE — $VERSION < 11.1.11 (CVE-2024-11741)"
      exit 1
    fi
    ;;
  11.2)
    if version_gte "$VERSION" "11.2.6"; then
      echo "PATCHED — $VERSION >= 11.2.6"
      exit 0
    else
      echo "VULNERABLE — $VERSION < 11.2.6 (CVE-2024-11741)"
      exit 1
    fi
    ;;
  11.3)
    if version_gte "$VERSION" "11.3.3"; then
      echo "PATCHED — $VERSION >= 11.3.3"
      exit 0
    else
      echo "VULNERABLE — $VERSION < 11.3.3 (CVE-2024-11741)"
      exit 1
    fi
    ;;
  11.4)
    if version_gte "$VERSION" "11.4.1"; then
      echo "PATCHED — $VERSION >= 11.4.1"
      exit 0
    else
      echo "VULNERABLE — $VERSION < 11.4.1 (CVE-2024-11741)"
      exit 1
    fi
    ;;
  11.5|11.[6-9]|1[2-9].*)
    echo "PATCHED — $VERSION is 11.5+ (fixed)"
    exit 0
    ;;
  *)
    if version_gte "$MAJOR_MINOR" "11.5"; then
      echo "PATCHED — $VERSION is beyond all affected branches"
      exit 0
    fi
    echo "UNKNOWN — $VERSION is outside the known affected range (10.4.x–11.4.x)"
    exit 2
    ;;
esac

1. Tenable Plugin 215000
2. Grafana Security Advisory — CVE-2024-11741
3. GitHub Advisory — GHSA-wxcc-2f3q-4h58
4. NVD — CVE-2024-11741
5. Grafana VictorOps Integration Guide
6. BleepingComputer — Grafana Internet Exposure Data
7. Grafana Contact Points Documentation