Grafana OnCall: unauthenticated plugin-install endpoint hands out a PluginAuthToken, yielding admin and API redirection

Impact

OnCall runs alongside Grafana in the observability stack most fleets use for GPU node and fabric alerting. An unauthenticated request to the internal plugin install endpoint, using the default stack_id and org_id values visible in the public source, returns a valid PluginAuthToken. With it an attacker reaches every internal API: create an Admin user, revoke the legitimate plugin token, and rewrite the organization's grafana_url and api_token so OnCall-to-Grafana calls go to a host they control. That last step both breaks on-call paging and leaks a Grafana API token - so the operator loses the alerting path they would use to notice a problem on the fleet, and the attacker gains a credential into the Grafana instance itself.

Who can reach it

Anyone able to send HTTP to the OnCall service - any tenant or user on a network that can reach the observability stack, and the internet if OnCall is published. No authentication and no prior account are required.

What to do

The record lists no fixed version (affected through 1.16.11) and no vendor advisory, only third-party write-ups, so treat this as mitigate-only for now: block external and tenant-network access to the OnCall service and its internal plugin endpoints at the ingress or network-policy layer, rotate the Grafana API token and the plugin token, and audit OnCall for unexpected Admin users and for a grafana_url that does not point at your own Grafana. Re-check for a Grafana advisory before scheduling a patch window.

References

Related entries

• Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table): The LiquidIO PF caches VF `pci_dev` pointersCVE-2026-72329 · Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table)Critical
• Dell Secure Connect Gateway: exposed Docker socket gives a local user or container host rootCVE-2026-80238 · Dell Secure Connect Gateway 5.0 (orchestrator container / exposed Docker socket)Critical
• MinIO (OIDC authentication): JWT algorithm confusion in the OIDC login path lets an attacker present a token the serverCVE-2026-33322 · MinIO (OIDC authentication)Critical
• rclone (rc API, options/set): options/set is exposed pre-authentication and can rewrite the running instance's authCVE-2026-41176 · rclone (rc API, options/set)Critical
• rclone (rc API, operations/fsinfo): operations/fsinfo is reachable without authentication and accepts anCVE-2026-41179 · rclone (rc API, operations/fsinfo)Critical
• Woodpecker CI: fork-approval gate bypassed by spoofing the git commit author nameCVE-2026-58370 · Woodpecker CI server (GitLab forge driver, ApprovalAllowedUsers matching)Critical