Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-10T14:59:35 grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L CWE-79

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks.

This Moderate flaw in Grafana allows an authenticated user with Editor permissions to inject malicious scripts into a dashboard's table panel. Viewing a compromised dashboard causes the script to execute in the user's browser, potentially leading to unauthorized access to sensitive information or client-side attacks. The requirement for elevated privileges limits the overall exposure. Red Hat products do not use the vulnerable code and hence are not affected. Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/acm-grafana-rhel9 Red Hat Ceph Storage 5 Not affected rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 Not affected rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 Not affected rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Not affected rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Not affected rhceph/grafana-rhel10 Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 9 Not affected grafana https://www.cve.org/CVERecord?id=CVE-2026-8595 https://nvd.nist.gov/vuln/detail/CVE-2026-8595 https://grafana.com/security/security-advisories/cve-2026-8595