CVE-2026-8595
published 2026-07-10CVE-2026-8595: A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.24%
15.3th percentile
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | >= 12.4.0 < 12.4.4 | 12.4.4 |
| grafana | grafana | >= 13.0.0 < 13.0.2 | 13.0.2 |
| grafana | grafana_oss | 12.4.0 – 12.4.3 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.1 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cr
ghsa_unreviewed·2026-07-10
CVE-2026-8595 [MEDIUM] CWE-79 A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cr
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Red Hat
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
vendor_redhat·2026-07-10·CVSS 5.4
CVE-2026-8595 [MEDIUM] CWE-79 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks.
Statement: This Moderate flaw in Grafana allows an authenticated user with Editor permissions to inject malicious scripts into a dashboard's table panel. Viewing a compromised dashboard causes the script to execute in the user's browser, potentially leading
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name [fedora-all]
bugzilla·2026-07-16·CVSS 5.4
CVE-2026-8595 [MEDIUM] CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name [fedora-all]
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Bugzilla
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
bugzilla·2026-07-10·CVSS 5.4
CVE-2026-8595 [MEDIUM] CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
CVE-2026-8595 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
2026-07-10
Published