CVE-2024-5526

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-05 · updated 2026-06-17
Weakness: CWE-918

Description

Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery (SSRF) vulnerability in the webhook functionallity. This issue was fixed in version 1.5.2

Affected products

Grafana OnCall: from 1.1.37 before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: Grafana OnCall 1.5.2. Check the vendor advisory for mitigations.

References

https://grafana.com/security/security-advisories/cve-2024-5526/
https://grafana.com/security/security-advisories/cve-2024-5526/

Get alerted when CVE-2024-5526 or the next vulnerability affects your stack