Bug 2528028 (CVE-2026-76154)

Summary:	CVE-2026-76154 grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting (XSS) vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By controlling the map style, an attacker can execute arbitrary JavaScript in the browser of anyone viewing the dashboard. If an Organization Administrator views the dashboard, the attacker's script can elevate their own account to Organization Administrator, leading to privilege escalation and unauthorized access to organizational dashboards, data source configurations, and credentials.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2544605
Bug Blocks:

Description OSIDB Bzimport 2026-09-03 13:56:17 UTC

Short description of the vulnerability:

The Geomap panel's MapLibre style base layer loads a map style from a URL and inserted that style's attribution field into the page without sanitising it. A user with only the Editor role can point the layer at a style they control and have arbitrary JavaScript run in the browser of anyone who views the dashboard. If an Org Admin opens the dashboard, the script runs in the admin's session and can raise the attacker's own account to Org Admin, giving them access to dashboards and data source configurations across the organisation, including any credentials stored in those data sources. No special configuration is required; the panel is enabled by default.

Known mitigations:

Update to one of the private builds listed above. Until you have updated, setting disable_plugins = geomap in the [plugins] section of grafana.ini (or the GF_PLUGINS_DISABLE_PLUGINS=geomap environment variable) and restarting Grafana removes the vulnerable panel, at the cost of breaking existing dashboards that use it. Enabling content_security_policy = true in the [security] section gives partial protection but is not a substitute for the update: it stops working once connect-src has been widened, which is common when direct-access data sources or plugins are in use.

Affected products and versions:
Grafana OSS and Grafana Enterprise: 12.3.0 to 12.3.11, 12.4.0 to 12.4.9, 13.0.0 to 13.0.7, 13.1.0 to 13.1.4, and 13.2.0. The earlier release of 12.2 is not affected.