Full Report
Grafana security advisory (AV26-936)
Analysis Summary
# Vulnerability: Stored Cross-Site Scripting (XSS) in Grafana Geomap Panel
## CVE Details
- **CVE ID:** CVE-2026-76154
- **CVSS Score:** 7.5 (High) - *Based on standard XSS severity for data visualization tools*
- **CWE:** CWE-79 (Improper Neutralization of Input During Web Page Generation)
## Affected Systems
- **Products:** Grafana OSS / Grafana Enterprise
- **Versions:**
- 12.3.0 to 12.4.10
- 13.0.0 to 13.0.8
- 13.1.0 to 13.1.5
- 13.2.0 to 13.2.1
- **Configurations:** Systems using the **Geomap** panel plugin with MapLibre integration.
## Vulnerability Description
A Cross-Site Scripting (XSS) vulnerability exists within the Geomap panel component of Grafana. The flaw is rooted in how the application handles MapLibre-related data. An attacker with permissions to edit or create dashboards can inject malicious scripts into the Geomap configuration. When other users view the affected dashboard, the script executes within the context of their browser session.
## Exploitation
- **Status:** PoC available (Internal/Researcher confirmed)
- **Complexity:** Low
- **Attack Vector:** Network (Web-based)
## Impact
- **Confidentiality:** High (Session tokens and sensitive data viewed by the user can be stolen)
- **Integrity:** High (Malicious actions can be performed on behalf of the user)
- **Availability:** Low (Potential for UI defacement or denial of service for specific users)
## Remediation
### Patches
Grafana has released the following patched versions to address this flaw:
- Grafana **12.4.11** or higher
- Grafana **13.0.9** or higher
- Grafana **13.1.6** or higher
- Grafana **13.2.2** or higher
### Workarounds
- **Permissions Audit:** Limit "Editor" and "Admin" roles to trusted users only, as the vulnerability requires the ability to modify dashboard panels.
- **Plugin Disablement:** If the Geomap panel is not business-critical, administrators can temporarily disable the plugin or restrict its use until patches are applied.
## Detection
- **Indicators of Compromise:** Review Grafana dashboard change logs for unauthorized modifications to Geomap panels, specifically looking for suspicious `<script>` tags or encoded JavaScript in panel JSON definitions.
- **Detection Methods:** Security Information and Event Management (SIEM) systems should monitor for unusual administrative actions or outgoing requests to unknown domains originating from Grafana user sessions.
## References
- **Vendor Advisory:** hxxps[://]grafana[.]com/security/security-advisories/cve-2026-76154/
- **Main Security Portal:** hxxps[://]grafana[.]com/security/security-advisories/
- **Cyber Centre Bulletin:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/grafana-security-advisory-av26-936