CVE-2026-8595: Grafana Stored XSS Vulnerability

CVE-2026-8595 Overview

CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability in Grafana's TableNG panel component. A user with Editor permissions can craft a dashboard whose table panel contains a malicious field name. When another user views the dashboard, the injected payload executes as script in their browser session. The vulnerability is tracked under CWE-79 and requires both authenticated privileges and victim interaction to succeed.

Critical Impact
An authenticated Editor can persist JavaScript in a dashboard field name that executes in the browser of any viewing user, enabling session theft and actions performed on behalf of the victim.

Affected Products

Grafana (open source distribution)
Grafana Enterprise
Deployments running the affected TableNG panel component

Discovery Timeline

2026-07-10 - CVE-2026-8595 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-8595

Vulnerability Analysis

The flaw resides in the TableNG panel rendering logic within Grafana. Field names originating from dashboard configuration are rendered into the DOM without sufficient output encoding. Because Editor-level users control the dashboard definition, they can supply a field name that contains executable JavaScript. When a viewer loads the dashboard, the browser interprets the field name as script rather than text. The stored nature of the payload means every subsequent viewer is exposed until the dashboard is remediated.

Exploitation crosses a security scope boundary because the malicious dashboard author (Editor) can target users with higher privileges, such as Admins, who view the dashboard. Successful execution grants the attacker script context inside the Grafana origin, exposing session tokens, API interactions, and any data the victim can access through the Grafana UI.

Root Cause

Grafana's TableNG panel fails to properly neutralize user-controlled input in the field name attribute before inserting it into the rendered HTML output. This missing sanitization on a trusted-appearing metadata field allows script content to persist in dashboard JSON and execute on render.

Attack Vector

The attack path requires an authenticated user with Editor permissions on a shared or organization-visible dashboard. The attacker creates or modifies a dashboard, adds a TableNG panel, and sets a field name containing an XSS payload. The dashboard is saved and shared with target users. When a victim opens the dashboard, the payload executes in their authenticated browser session. The attack is network-reachable, has low complexity, and requires user interaction from the victim.

Because no verified proof-of-concept code is published, refer to the Grafana Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-8595

Indicators of Compromise

Dashboard JSON definitions containing HTML tags, event handler attributes, or javascript: URIs within TableNG panel fieldConfig field names.
Audit log entries showing dashboard save or update actions by Editor accounts followed by unusual API calls initiated from Admin sessions.
Unexpected outbound requests from browsers loading Grafana dashboards, indicating script-driven data exfiltration.

Detection Strategies

Scan stored dashboard JSON for suspicious patterns in field name properties, including <script, onerror=, onload=, and encoded variants.
Enable and review Grafana audit logs for dashboard modifications by Editor-role accounts, particularly on dashboards shared with higher-privileged users.
Deploy Content Security Policy (CSP) reporting to surface inline script execution blocked or attempted within the Grafana origin.

Monitoring Recommendations

Alert on newly created or modified dashboards that contain HTML control characters in panel metadata fields.
Correlate dashboard edit events with subsequent privileged API calls made from the same browser session within a short time window.
Review Editor account activity for accounts that recently gained access to sensitive dashboards or folders.

How to Mitigate CVE-2026-8595

Immediate Actions Required

Upgrade Grafana to a fixed release identified in the Grafana Security Advisory.
Audit existing dashboards for TableNG panels containing suspicious field names and remove or sanitize any offending entries.
Review Editor-role assignments and revoke access from accounts that do not require dashboard authoring privileges.

Patch Information

Grafana Labs has issued a security advisory for CVE-2026-8595. Consult the Grafana Security Advisory for the exact fixed versions applicable to open source Grafana and Grafana Enterprise builds, and apply the upgrade across all instances.

Workarounds

Restrict Editor permissions to trusted users only, and prefer Viewer role assignments for broad access.
Apply a strict Content Security Policy that disallows inline script execution on the Grafana origin to reduce impact if a payload is stored.
Segment sensitive dashboards into folders with tighter access controls so that untrusted Editors cannot modify dashboards viewed by Admins.

bash

# Example: verify Grafana version and review dashboards for suspicious field names
grafana-cli --version

# Extract dashboards and grep for potential XSS payloads in field names
curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" \
  "$GRAFANA_URL/api/search?type=dash-db" | jq -r '.[].uid' | \
  while read uid; do
    curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" \
      "$GRAFANA_URL/api/dashboards/uid/$uid" | \
      grep -Ei '<script|onerror=|onload=|javascript:' && echo "Review dashboard: $uid"
  done