CVE-2026-76154: CVE-2026-76154 CVE Record

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-09-18
Weakness: CWE-79

Description

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Affected products

Grafana: from 12.4.0 through 12.4.10; from 13.0.0 through 13.0.8; from 13.1.0 through 13.1.5; from 13.2.0 through 13.2.1; 12.3.0

References

https://grafana.com/security/security-advisories/cve-2026-76154

Get alerted when CVE-2026-76154 or the next vulnerability affects your stack