Grafana Labs Integration URL Exposed to Viewers

Grafana's Alerting subsystem lets you configure contact points — outbound webhooks that fire when an alert triggers. The DingDing integration (a chat platform used mostly by organizations with China/APAC operations) stores its webhook URL in the contact point config. Because that URL field was not marked as secure, it was returned in cleartext to any user with Viewer role who queried the alerting configuration API. The webhook URL typically contains an access_token query parameter that, if leaked, lets an attacker post arbitrary messages into the target DingDing group. Affected: Grafana <10.4.19, <11.2.10, <11.3.7, <11.4.5, <11.5.5, <11.6.2, <12.0.1. Fixed in the +security-01 suffixed builds.

Grafana labeled this MEDIUM (4.3) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That's a fair ceiling but overstates the practical impact for most fleets. The bug requires an authenticated Viewer account, the affected integration is DingDing specifically (not Slack/Teams/PagerDuty/Opsgenie), the leaked artifact is a chat webhook — not credentials into your infra — and the worst-case abuse is spamming or phishing a chat channel. For enterprises that don't use DingDing this is a non-event; for those that do, it's a LOW with a documentation footnote about rotating the webhook token.

Why this verdict

• Authenticated precondition: requires a valid Viewer session — no unauthenticated internet path exists, immediately narrowing the attacker population to insiders and post-initial-access adversaries.
• Feature-specific: only fires if DingDing is actually configured as a contact point. Slack/Teams/PagerDuty/Opsgenie/Webhook users are unaffected. Most Western enterprises will not have DingDing configured.
• Blast radius is a chat webhook: the leaked artifact posts messages to one DingDing group. It does not grant access to Grafana admin, dashboards, datasources, cloud credentials, or the host. There is no lateral pivot.
• Role multiplier — Grafana Alerting instance: the affected component is a monitoring UI, not identity/PKI/hypervisor/CI-CD/backup/edge/kernel-agent infrastructure. Even in the worst high-value deployment (SRE central alerting), the chain caps at chat-channel abuse. No floor is triggered.
• No exploitation signal: EPSS is negligible, KEV silent, no PoC repos, no reported campaigns.

Why not higher?

MEDIUM would require either an unauthenticated path or a more damaging secret (datasource credentials, service-account tokens). The leak is bounded to DingDing webhook URLs and requires Viewer role, which is not enough to justify the vendor's 4.3.

Why not lower?

Not IGNORE because organizations that do use DingDing genuinely expose an API token to any Viewer, and rotating it takes real coordination. It's LOW rather than IGNORE so it lands in a hygiene queue rather than being written off.

1. Inventory DingDing contact points across all Grafana tenants — Run GET /api/v1/provisioning/contact-points as admin on every instance and grep for dingding. If none are configured, this CVE is inapplicable to your fleet — document and close. Complete inventory within the standard backlog window; there is no noisgate mitigation SLA for LOW.
2. Rotate DingDing webhook tokens where the integration is in use — Generate a new DingDing robot access_token, update the Grafana contact point, and revoke the old token in the DingDing admin console. This defangs any URL already harvested by a Viewer. Do this alongside the version upgrade.
3. Audit Viewer-role accounts and Viewer API access logs — Pull 90 days of /api/v1/provisioning/contact-points reads by Viewer accounts; any Viewer hitting provisioning endpoints is anomalous and worth a look. Feed into your existing SIEM detections.
4. Upgrade Grafana to the +security-01 build on your branch — The fix marks the DingDing url field as secure, so it is redacted from Viewer-facing API responses. Use your normal Grafana upgrade cadence — no expedited change window needed.
5. Constrain Viewer role via team-scoped folder permissions — If Viewer must access alert rules, scope them to specific folders that do not contain the DingDing contact point. Reduces the blast radius of any similar future disclosure bug.

Run on an auditor workstation with network reachability to the Grafana API. Requires an admin API token to enumerate contact points. Invoke as GRAFANA_URL=https://grafana.corp GRAFANA_TOKEN=glsa_xxx ./check-cve-2025-3415.sh. Outputs VULNERABLE if Grafana version is below the fix AND a DingDing contact point exists, PATCHED if on a +security-01 build, UNKNOWN otherwise.

#!/usr/bin/env bash
# check-cve-2025-3415.sh — assess Grafana exposure to CVE-2025-3415
# Usage: GRAFANA_URL=https://grafana.corp GRAFANA_TOKEN=glsa_xxx ./check-cve-2025-3415.sh
set -euo pipefail

: "${GRAFANA_URL:?set GRAFANA_URL}"
: "${GRAFANA_TOKEN:?set GRAFANA_TOKEN (admin service account token)}"

AUTH=(-H "Authorization: Bearer ${GRAFANA_TOKEN}" -H "Accept: application/json")

# 1. Fetch version
VER_JSON=$(curl -fsS "${AUTH[@]}" "${GRAFANA_URL%/}/api/health" || true)
VERSION=$(printf '%s' "$VER_JSON" | sed -n 's/.*"version"[^"]*"\([^"]*\)".*/\1/p')
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not read /api/health"; exit 2
fi
echo "Detected Grafana version: $VERSION"

# 2. Check if patched build (looks for +security-01 or newer patch stream)
if printf '%s' "$VERSION" | grep -qE '\+security-0[1-9]'; then
  PATCHED_BUILD=1
else
  PATCHED_BUILD=0
fi

# 3. Enumerate contact points and look for DingDing
CP_JSON=$(curl -fsS "${AUTH[@]}" "${GRAFANA_URL%/}/api/v1/provisioning/contact-points" || echo '[]')
if printf '%s' "$CP_JSON" | grep -qiE '"type"[[:space:]]*:[[:space:]]*"dingding"'; then
  HAS_DINGDING=1
else
  HAS_DINGDING=0
fi

# 4. Verdict
if [[ $PATCHED_BUILD -eq 1 ]]; then
  echo "PATCHED: running $VERSION (contains +security-01 fix)"
  exit 0
fi

if [[ $HAS_DINGDING -eq 0 ]]; then
  echo "UNKNOWN: version $VERSION is pre-fix but no DingDing contact point configured — CVE not applicable to this instance"
  exit 0
fi

echo "VULNERABLE: version $VERSION is pre-fix AND DingDing contact point is configured — Viewer role can read the webhook URL"
exit 1

Sources

1. Grafana Labs security advisory — CVE-2025-3415
2. Grafana blog — Medium severity security release for CVE-2025-3415
3. NVD — CVE-2025-3415
4. Tenable Nessus plugin 242626
5. Wiz vulnerability database — CVE-2025-3415
6. Red Hat Bugzilla 2374548 (Fedora backport tracking)
7. Broadcom / VMware advisory for Grafana in Healthwatch
8. SecurityOnline write-up