Stored XSS in Grafana Dashboard TableNG Panels

Executive Summary

CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability in Grafana's table panel (TableNG).

A user with Editor permissions can create a dashboard containing a malicious field name that executes as a script in the browsers of anyone who views that dashboard.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized script execution in the browsers of users who view the malicious dashboard.

As a result, it could compromise user sessions or data integrity, potentially allowing attackers to steal information or perform actions on behalf of the user.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users are advised to upgrade Grafana to a fixed version. Specifically, upgrade to version 12.4.4 or later, or 13.0.2 or later, where the stored cross-site scripting issue in the table panel (TableNG) has been resolved.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized script execution in the browsers of users viewing a malicious dashboard, which could lead to compromised user sessions or data integrity.

Such unauthorized access or data compromise may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of user data and secure handling of personal information.

Therefore, if exploited, this vulnerability could result in violations of these regulations due to potential data breaches or unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stored cross-site scripting (XSS) attack through a malicious field name in Grafana dashboards created by users with Editor permissions. Detection typically involves inspecting Grafana dashboards for suspicious or unexpected script content in table panel field names.

Since the vulnerability manifests in the browser when viewing dashboards, network detection might be limited. However, you can check your Grafana instance version to see if it is vulnerable.

Suggested commands to detect potentially vulnerable Grafana versions:

• Check Grafana version via API: curl -s http://<grafana-server>/api/health | grep version
• Check Grafana version via CLI or installed package manager, e.g., grafana-server -v

To detect malicious dashboards, manual inspection or automated scripts to parse dashboard JSON for suspicious script tags or unusual field names in TableNG panels would be necessary, but no specific commands are provided in the available resources.

Useful 0 Not Useful 0