CVE-2025-12141

Description

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.

How to fix CVE-2025-12141

To remediate CVE-2025-12141, upgrade the affected package to a fixed version below.

• —upgrade to 12.3.1 or later

Is CVE-2025-12141 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 8.0.0, < 12.3.1

CVSS scores

References (2)

• WEBgrafana.com/security/security-advisories/cve-2025-12141/
• WEBnvd.nist.gov/vuln/detail/CVE-2025-12141