CVE-2026-8595: grafana from 12.4.0 (inclusive), before 12.4.4 (exclusive), from 13.0.0 (inclusive), before 13.0.2 (exclusive); +1…

Affected technology

grafana · from 12.4.0 (inclusive), before 12.4.4 (exclusive)
grafana

grafana · from 13.0.0 (inclusive), before 13.0.2 (exclusive)
grafana

Grafana OSS · 12.4.0 through 12.4.3, 13.0.0 through 13.0.1
Grafana

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting). Vendor/CNA’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality impact as high; integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.