CVE-2026-9029: Geomap Panel XSS Vulnerability Bypass

CVE-2026-9029 Overview

CVE-2026-9029 is a stored cross-site scripting (XSS) vulnerability in the Grafana geomap panel. The flaw resides in the XYZ tile layer, where a sanitize-then-interpolate ordering bug allows attacker-controlled template variable values to reach the DOM unescaped. The sanitizeTextPanelContent() function runs on the raw template string before getTemplateSrv().replace() substitutes the variable value using the glob format, which performs no HTML escaping. The resulting string is assigned to element.innerHTML inside OpenLayers. The issue is a bypass of the prior fix for CVE-2023-0507 and is classified under [CWE-79].

Critical Impact
An Editor can set a textbox variable's default value to an XSS payload that executes in the browser of every user who loads the affected dashboard.

Affected Products

Grafana geomap panel (XYZ tile layer)
Grafana dashboards using textbox template variables
Deployments that rely on the prior CVE-2023-0507 sanitization fix

Discovery Timeline

2026-06-22 - CVE-2026-9029 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-9029

Vulnerability Analysis

The geomap panel renders XYZ tile layer attribution strings that may contain dashboard template variables. Grafana applies sanitizeTextPanelContent() to the template literal before any variable substitution occurs. Sanitization at this stage only inspects static markup. After sanitization, getTemplateSrv().replace() interpolates variable values using the glob format, which does not encode HTML metacharacters. The combined output is then passed to OpenLayers and written to the DOM through element.innerHTML, causing the browser to parse and execute any injected markup.

Root Cause

The root cause is incorrect ordering between sanitization and template interpolation. Sanitization runs against the pre-interpolation string and never observes the attacker-controlled value. Because the glob format omits HTML escaping, raw <script> tags and event handlers survive the substitution step. The original fix for CVE-2023-0507 addressed similar template-driven XSS in other panels but did not cover the geomap XYZ layer code path.

Attack Vector

An authenticated user with the Editor role creates or modifies a dashboard, defines a textbox template variable, and sets its default value to an XSS payload such as <img src=x onerror=fetch('/api/user').then(...)>. When any viewer opens the dashboard, the geomap panel resolves the variable, fails to escape the value, and executes the script in the viewer's session. Exploitation requires network access to the Grafana instance, low privileges (Editor), and user interaction (loading the dashboard). Successful exploitation can be used to steal session tokens, perform actions on behalf of higher-privileged users such as Admins, or pivot to internal data sources.

No verified public proof-of-concept code is available. Refer to the Grafana Security Advisory CVE-2026-9029 for vendor technical details.

Detection Methods for CVE-2026-9029

Indicators of Compromise

Dashboard JSON definitions containing textbox template variables whose default values include HTML tags, javascript: URIs, or event handler attributes such as onerror= or onload=.
Geomap panels configured with an XYZ tile layer where the attribution or URL templates reference template variables.
Unexpected outbound requests from browser sessions of users viewing Grafana dashboards, particularly to attacker-controlled domains.

Detection Strategies

Audit Grafana dashboard JSON exports and the dashboard_version table for variable definitions matching XSS patterns (<script, onerror=, onload=, javascript:).
Inspect Grafana audit logs for dashboard create and update events from Editor accounts, correlating with template variable changes.
Monitor browser-side telemetry and content security policy (CSP) violation reports for inline script executions originating from Grafana origins.

Monitoring Recommendations

Forward Grafana audit logs and reverse proxy access logs to a centralized analytics platform for anomaly review.
Alert on Editor role assignments and on bulk dashboard modifications outside change windows.
Track usage of the geomap panel across the environment and flag dashboards that combine geomap with templated tile layers.

How to Mitigate CVE-2026-9029

Immediate Actions Required

Upgrade Grafana to the fixed version listed in the Grafana Security Advisory CVE-2026-9029.
Review all dashboards that use the geomap panel and remove or sanitize textbox variable default values that contain HTML or script content.
Restrict the Editor role to trusted users and require change review for dashboard modifications.

Patch Information

Grafana Labs has published a security advisory for CVE-2026-9029. Apply the vendor-provided patched release. Consult the Grafana Security Advisory CVE-2026-9029 for exact fixed versions and upgrade guidance.

Workarounds

Disable or remove geomap panels that use XYZ tile layers until patching is complete.
Enforce a strict Content Security Policy on the Grafana origin to block inline scripts and unauthorized event handlers.
Limit Editor permissions and require dashboard provisioning through version-controlled files reviewed by security staff.

bash

# Configuration example: enforce CSP via reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  style-src 'self' 'unsafe-inline'; \
  img-src 'self' data: https:; \
  object-src 'none'; \
  frame-ancestors 'none'" always;