CVE-2026-8595

A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks.

This Moderate flaw in Grafana allows an authenticated user with Editor permissions to inject malicious scripts into a dashboard's table panel. Viewing a compromised dashboard causes the script to execute in the user's browser, potentially leading to unauthorized access to sensitive information or client-side attacks. The requirement for elevated privileges limits the overall exposure.

Red Hat products do not use the vulnerable code and hence are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.