CVE-2026-76154
published 2026-09-17CVE-2026-76154: A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in…
PriorityP338high7.3CVSS 3.1
AVNACLPRLUIRSUCHIHAN
EPSS
0.35%
27.4th percentile
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | — | — |
| grafana | grafana_enterprise | 12.4.0 – 12.4.10 | — |
| grafana | grafana_enterprise | 13.0.0 – 13.0.8 | — |
| grafana | grafana_enterprise | 13.1.0 – 13.1.5 | — |
| grafana | grafana_enterprise | 13.2.0 – 13.2.1 | — |
| grafana | grafana_oss | — | — |
| grafana | grafana_oss | 12.4.0 – 12.4.10 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.8 | — |
| grafana | grafana_oss | 13.1.0 – 13.1.5 | — |
| grafana | grafana_oss | 13.2.0 – 13.2.1 | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
vendor_redhat·2026-09-30·CVSS 7.3
CVE-2026-76154 [HIGH] CWE-79 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting (XSS) vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By controlling the map style, an attacker can execute arbitrary JavaScript in the browser of anyone viewing the dashboard. If an Organization Administrator views the d
GHSA
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a maliciou
ghsa_unreviewed·2026-09-17
CVE-2026-76154 [HIGH] CWE-79 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a maliciou
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation [fedora-all]
bugzilla·2026-10-01·CVSS 7.3
CVE-2026-76154 [HIGH] CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation [fedora-all]
CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Short description of the vulnerability:
The Geomap panel's MapLibre style base layer loads a map style from a URL and inserted that style's attribution field into the page without sanitising it. A user with only the Editor role can point the layer at a style they control and have arbitrary JavaScript run in the browser of anyone who views the dashboard. If an Org Admin opens the dashboard, the script runs in the admin's session and can raise the attacker's
Bugzilla
CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
bugzilla·2026-09-03·CVSS 7.3
CVE-2026-76154 [HIGH] CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
Short description of the vulnerability:
The Geomap panel's MapLibre style base layer loads a map style from a URL and inserted that style's attribution field into the page without sanitising it. A user with only the Editor role can point the layer at a style they control and have arbitrary JavaScript run in the browser of anyone who views the dashboard. If an Org Admin opens the dashboard, the script runs in the admin's session and can raise the attacker's own account to Org Admin, giving them access to dashboards and data source configurations across the organisation, including any credentials stored in those data sources. No special configuration is required; the panel is enabled by defa
2026-09-17
Published