CVE-2026-76154
Fixed in a distro release EPSS <1%CVSS 7.3
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
Products: Grafana OSS, Grafana Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.2.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.6-0.5.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.3-0.1.hum1 |
| openSUSE Tumbleweed | grafana | 12.4.11-1.1 |