Description
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
Published: 2026-09-17
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution & Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw in the Geomap panel’s MapLibre base layer. An attacker with an Editor role can place a malicious style configuration that is persisted on the server. When another user opens a dashboard containing that panel, the browser executes the embedded JavaScript within the context of the target user’s session.

Affected Systems

Affected products are Grafana Enterprise and Grafana OSS. The CVE does not list specific version numbers, so any deployment that includes the Geomap panel with the MapLibre base layer is potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS score is 7.3, indicating high severity. The EPSS score is less than 1% and the vulnerability is not in the CISA KEV catalog, implying a low but non‑zero probability of exploitation. The attack requires an attacker to craft a malicious style configuration under an Editor role; once stored, any viewer of the affected dashboard will run the JavaScript in their browser, allowing the attacker to tamper with permissions or gain Org Admin status.

Generated by OpenCVE AI on September 19, 2026 at 02:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch when released; the Grafana security advisories page lists the fixed version.
  • Restrict access to the Geomap panel to users with fewer privileges or remove the ability to edit style configurations for non‑administrators.
  • Enable or enforce a strict Content Security Policy that blocks inline scripts in Grafana dashboards.
  • Monitor dashboard configuration changes for unfamiliar style URLs or remote script references.

Generated by OpenCVE AI on September 19, 2026 at 02:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Grafana grafana Enterprise
Vendors & Products Grafana
Grafana grafana
Grafana grafana Enterprise
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
Title CVE-2026-76154 CVE Record
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'}

Subscriptions

Grafana Grafana Grafana Enterprise
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-09-18T17:34:10.251Z

Reserved: 2026-08-19T07:45:07.588Z

Link: CVE-2026-76154

cve-icon Vulnrichment

Updated: 2026-09-18T17:34:00.307Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-17T21:17:37.760

Modified: 2026-09-18T19:34:36.657

Link: CVE-2026-76154

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-30T12:36:52Z

Links: CVE-2026-76154 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T02:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')