CVE-2026-8595
published 2026-07-10CVE-2026-8595: A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.30%
21.3th percentile
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | >= 12.4.0 < 12.4.4 | 12.4.4 |
| grafana | grafana | >= 13.0.0 < 13.0.2 | 13.0.2 |
| grafana | grafana_oss | 12.4.0 – 12.4.3 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.1 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Grafana up to 12.4.3/13.0.1 TableNG Panel field name cross site scripting (EUVD-2026-42922 / Nessus ID 327813)
vuldb·2026-08-27·CVSS 5.4
CVE-2026-8595 [MEDIUM] Grafana up to 12.4.3/13.0.1 TableNG Panel field name cross site scripting (EUVD-2026-42922 / Nessus ID 327813)
A vulnerability has been found in Grafana up to 12.4.3/13.0.1 and classified as problematic. The impacted element is an unknown function of the component TableNG Panel. This manipulation of the argument field name causes cross site scripting.
This vulnerability is tracked as CVE-2026-8595. The attack is possible to be carried out remotely. No exploit exists.
GHSA
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cr
ghsa_unreviewed·2026-07-10
CVE-2026-8595 [MEDIUM] CWE-79 A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cr
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Red Hat
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
vendor_redhat·2026-07-10·CVSS 5.4
CVE-2026-8595 [MEDIUM] CWE-79 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks.
Statement: This Moderate flaw in Grafana allows an authenticated user with Editor permissions to inject malicious scripts into a dashboard's table panel. Viewing a compromised dashboard causes the script to execute in the user's browser, potentially leading
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name [fedora-all]
bugzilla·2026-07-16·CVSS 5.4
CVE-2026-8595 [MEDIUM] CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name [fedora-all]
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Bugzilla
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
bugzilla·2026-07-10·CVSS 5.4
CVE-2026-8595 [MEDIUM] CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
2026-07-10
Published