CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint
Remote attackers can hijack authentication tokens via hardcoded defaults to create admin users and redirect API calls in Grafana OnCall.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63087?
CVE-2026-63087 is a critical authentication bypass vulnerability in grafana-cold-storage oncall, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.
Weakness: CWE-306
Which versions are affected by CVE-2026-63087?
How do I fix CVE-2026-63087?
No fix has been published for CVE-2026-63087 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-63087 being exploited?
There is no known exploitation of CVE-2026-63087 in the wild and no public exploit code.
Sources
Also known as GHSA-whw8-2869-jf7j.