CVE-2024-5526 - CVE House
Back to Database
Status published High CVE-2024-5526

Grafana OnCall is an easy-to-use on-call management tool that will...

Vulnerability Description

Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery (SSRF) vulnerability in the webhook functionallity. This issue was fixed in version 1.5.2

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5526

Credits & Attribution

No credits recorded in the NVD database.

References

More from Grafana

View All →
CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium 5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium 4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High 7.6
CVE-2025-4123
A cross-site scripting (XSS) vulnerability exists in Grafana caused by...
High 7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical 9.1

Affected Vendor

Affected Software

OnCall
Vulnerable Versions:
1.1.37

Timeline

Official Publish: June 5th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery