CVE-2024-5526 is a high severity (CVSS 7.7) server side request forgery in the webhook feature of Grafana OnCall. Versions from 1.1.37 up to, but not including, 1.5.2 are affected. Grafana fixed it in 1.5.2, so upgrade to that release or later and review webhook destinations.
What's affected
Grafana's advisory and the NVD record agree on the range: Grafana OnCall from 1.1.37 before 1.5.2. The advisory lists the fixed version as 1.5.2 or newer and gives the publication date as 30 May 2024.
The score and vector also match. Grafana publishes 7.7 with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. Read that vector this way: reachable over the network, low complexity, a low privilege account, no user interaction, and a changed scope with high confidentiality impact. The changed scope is the honest signal of SSRF. The vulnerable component is OnCall, but what it can reach lives elsewhere.
The advisory is short. It names the webhook functionality and nothing more about the mechanism, so the details here stop where the advisory stops.
How to check if you're exposed
Start with the version. How you read it depends on how you deployed OnCall.
For a container deployment, look at the image tag your orchestrator runs. With Kubernetes and Helm, these two commands show it:
helm list --all-namespaces
kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i oncall
If you use the Grafana Cloud hosted service, the vendor operates the engine, so check the advisory and your stack status for anything required from you.
Next, list the webhooks you have configured, and who is allowed to create them. Because the flaw needs an authenticated user with low privileges, the people who can add webhooks matter as much as the version.
What to do now
- Upgrade Grafana OnCall to 1.5.2 or later.
- Export your current webhook list and note each destination URL.
- Restrict who can create or edit webhooks to the smallest group that needs it.
- Where the OnCall host can reach internal services or cloud metadata endpoints, tighten egress rules so only intended destinations are open.
- Re-check the version after the upgrade and keep a record of the date.
Why it matters
CWE-918, server side request forgery, is a weakness where a service can be coaxed into making requests on behalf of a user. The requests come from the server's own network position, which usually sees more than the person's browser does.
An on call tool is a good example of why that matters. It runs inside your infrastructure and needs to call out to chat systems, ticketing and monitoring. A webhook feature is exactly where users supply a destination. The record does not mark this as exploited and it is not in CISA KEV, so the aim is orderly patching and tighter egress, which also limits the damage from the next bug of this kind.
Try it yourself
Not every SSRF is equally reachable in your setup. This demo walks through checking exposure before you rank the fix.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-5526?
Grafana OnCall 1.5.2. The advisory lists fixed versions as 1.5.2 or newer, and the affected range starts at 1.1.37.
Why is the scope marked as changed?
Because the impact lands on components beyond OnCall itself. The server makes the request, so what it can reach, not OnCall's own data, drives the confidentiality score.
Sources
Last reviewed: 19 October 2026.
