CVE-2026-8595

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-8595	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:grafana:grafana:::::-:::*
	cpe:2.3:a:grafana:grafana:::::-:::*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Un usuario con permisos de Editor puede crear un panel de control cuyo panel de tabla (TableNG) contiene un nombre de campo malicioso que se ejecuta como un script en el navegador de cualquier usuario que ve el panel de control (cross-site scripting almacenado).

Information

Published : 2026-07-10 16:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-8595

Mitre link : CVE-2026-8595

CVE.ORG link : CVE-2026-8595

JSON object : View

Products Affected

grafana

grafana

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-8595", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8595", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T15:59:08.422134Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-10T16:16:39.400", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-8595", "tags": ["Vendor Advisory"], "source": "security@grafana.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@grafana.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting)."}, {"lang": "es", "value": "Un usuario con permisos de Editor puede crear un panel de control cuyo panel de tabla (TableNG) contiene un nombre de campo malicioso que se ejecuta como un script en el navegador de cualquier usuario que ve el panel de control (cross-site scripting almacenado)."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "F820291A-C1C6-4DBC-8064-6133F16547C4", "versionEndExcluding": "12.4.4", "versionStartIncluding": "12.4.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "643002A3-545F-4605-AAAF-EF55C5B14392", "versionEndExcluding": "13.0.2", "versionStartIncluding": "13.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}