VDB
CVE-2026-9029
CVE-2026-9029
PUBLISHED
CVSS 7.3 HIGH
Reported by GRAFANA · Published June 22, 2026
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
Risk Scores
CVSS 3.1
7.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana OSS | 12.4.0, 13.0.0 |
| Grafana | Grafana OSS | 13.0.0, 12.4.0, 13.0.0 |
| github.com | grafana/grafana | 2.0.0-beta1, 13.0.0, 0 |
| alpine | grafana | 0, 0, 0 |
Timeline
- Jun 22, 2026 CVE Published
- Jun 23, 2026 EPSS Score
- Jun 23, 2026 Security Advisory
- Jun 24, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 15, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
References
- vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9029 advisory
- https://github.com/advisories/GHSA-9g84-39mm-q4p3 advisory
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1 patch
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29 patch
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4 patch
- https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58 patch
- https://github.com/grafana/grafana/releases/tag/v12.4.4 url
- https://github.com/grafana/grafana/releases/tag/v13.0.2 url