CVE-2026-76154

A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting (XSS) vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By controlling the map style, an attacker can execute arbitrary JavaScript in the browser of anyone viewing the dashboard. If an Organization Administrator views the dashboard, the attacker's script can elevate their own account to Organization Administrator, leading to privilege escalation and unauthorized access to organizational dashboards, data source configurations, and credentials.

Important: A stored cross-site scripting vulnerability in the Grafana Geomap panel allows an authenticated attacker with Editor privileges to escalate their privileges to Org Admin. This is due to unsanitized input in the MapLibre style base layer's attribution field, which can execute arbitrary JavaScript in an administrator's browser session when they view a crafted dashboard. The Geomap panel is enabled by default, requiring no special configuration for exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Geomap plugin. This can be achieved by setting disable_plugins = geomap in the [plugins] section of the grafana.ini configuration file, or by setting the environment variable GF_PLUGINS_DISABLE_PLUGINS=geomap. A restart of the Grafana service is required for the changes to take effect. Disabling the plugin will remove the Geomap panel and may affect existing dashboards that utilize it.