CVE-2026-76154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76154", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-08-19T07:45:07.588Z", "datePublished": "2026-09-17T20:22:55.718Z", "dateUpdated": "2026-10-14T10:12:30.371Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.10", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.8", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.5", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.1", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.10", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.8", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.5", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.1", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Eric Sowah Badger (niihack)"}], "datePublic": "2026-08-19T07:45:08.551Z", "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin."}], "metrics": [{"cvssV3_1": {"baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-14T10:12:30.371Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-76154"}], "source": {"discovery": "BUG_BOUNTY"}, "title": "CVE-2026-76154 CVE Record"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T17:33:54.472083Z", "id": "CVE-2026-76154", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T17:34:10.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-18T17:33:54.472083Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T17:34:00.307Z"}}], "cna": {"title": "CVE-2026-76154 CVE Record", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "Eric Sowah Badger (niihack)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.10"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.8"}, {"status": "affected", "version": "13.1.0", "versionType": "semver", "lessThanOrEqual": "13.1.5"}, {"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.1"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.10"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.8"}, {"status": "affected", "version": "13.1.0", "versionType": "semver", "lessThanOrEqual": "13.1.5"}, {"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-19T07:45:08.551Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-76154", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-14T10:12:30.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76154", "state": "PUBLISHED", "dateUpdated": "2026-10-14T10:12:30.371Z", "dateReserved": "2026-08-19T07:45:07.588Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-09-17T20:22:55.718Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.10", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.8", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.5", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.1", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.10", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.8", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.5", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.1", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin."}], "id": "CVE-2026-76154", "lastModified": "2026-09-18T19:34:36.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.2, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76154", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T17:33:54.472083Z", "version": "2.0.3"}}]}, "published": "2026-09-17T21:17:37.760", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-76154"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:73655", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "grafana13-1-main-13.1.6-0.5.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-09-30T00:00:00Z"}], "bugzilla": {"description": "grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation", "id": "2528028", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528028"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-79", "details": ["A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.", "A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting (XSS) vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By controlling the map style, an attacker can execute arbitrary JavaScript in the browser of anyone viewing the dashboard. If an Organization Administrator views the dashboard, the attacker's script can elevate their own account to Organization Administrator, leading to privilege escalation and unauthorized access to organizational dashboards, data source configurations, and credentials."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, disable the Geomap plugin. This can be achieved by setting `disable_plugins = geomap` in the `[plugins]` section of the `grafana.ini` configuration file, or by setting the environment variable `GF_PLUGINS_DISABLE_PLUGINS=geomap`. A restart of the Grafana service is required for the changes to take effect. Disabling the plugin will remove the Geomap panel and may affect existing dashboards that utilize it."}, "name": "CVE-2026-76154", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Under investigation", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Under investigation", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Under investigation", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-30T12:36:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76154\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76154"], "statement": "Important: A stored cross-site scripting vulnerability in the Grafana Geomap panel allows an authenticated attacker with Editor privileges to escalate their privileges to Org Admin. This is due to unsanitized input in the MapLibre style base layer's attribution field, which can execute arbitrary JavaScript in an administrator's browser session when they view a crafted dashboard. The Geomap panel is enabled by default, requiring no special configuration for exploitation.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.1]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-09-18T21:30:14.143915+00:00", "title": "Stored XSS in Grafana Geomap Panel Enables JavaScript Execution and Admin Escalation", "updated": "2026-09-19T02:30:17.316757+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}