CVE-2026-8595: Grafana TableNG Stored XSS via Field Names (CVSS 6.8)

Technical summary

CVE-2026-8595 is a stored XSS vulnerability in Grafana's TableNG panel implementation. The vulnerability exists because field names in table panels are not properly sanitized before being rendered in the DOM. An authenticated user with Editor role permissions can inject arbitrary JavaScript into a field name; when the dashboard is viewed by any user with access, the injected script executes in their browser context. The attack leverages the trust relationship users have with dashboards authored by internal or trusted parties. No user interaction beyond viewing the dashboard is required to trigger execution, distinguishing this from reflected XSS variants.

Business impact

This vulnerability enables account compromise and data exfiltration within Grafana environments. An Editor-level attacker can harvest session tokens, API keys, or sensitive dashboard data from other users' browsers—particularly high-impact when dashboards are shared across teams. In multi-tenant or cloud-hosted Grafana instances, a compromised Editor account effectively becomes a pivot point for lateral movement. Organizations relying on Grafana for operational visibility face integrity and confidentiality risks, especially if dashboards are used for incident response or security monitoring where data authenticity is assumed.

Affected systems

Grafana instances containing the TableNG panel component are affected. The vulnerability requires Editor-level or higher permissions to exploit, limiting direct attack surface to internal users, federated accounts, or service principals with dashboard creation rights. Organizations using Grafana for metrics, logs, or trace visualization are at risk if their dashboard author base is not strictly controlled. Community editions and enterprise editions are both in scope.

Exploitability

Exploitability is moderately straightforward: an Editor-level account can execute the attack within minutes by creating or editing a dashboard. No special tooling or zero-day research is required—the attack vector is a simple field name input. However, the attacker must possess valid Editor credentials, which limits opportunistic exploitation. The CVSS score of 6.8 (MEDIUM) reflects this trade-off: high confidentiality impact and low attack complexity, moderated by the requirement for privileged user access and the need for a viewer to visit the dashboard. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication.

Remediation

Vendors should release a patch that properly sanitizes or encodes field names before rendering them in the TableNG panel DOM. Input validation at the API level (rejecting or escaping special characters in field names) combined with output encoding in the frontend (HTML entity encoding or Content Security Policy) will mitigate the issue. Organizations should prioritize patching systems where dashboards are shared across trust boundaries.

Patch guidance

Monitor Grafana's official security advisories and release notes for a patched version addressing this vulnerability. Apply patches to all Grafana instances, prioritizing those in production environments or exposed to users outside your immediate control. Before patching, audit your Grafana instance for dashboards with suspiciously named fields—look for field names containing script tags, event handlers (onclick, onload), or URL schemes (javascript:). Test patches in a staging environment to confirm compatibility with existing dashboards and plugins.

Detection guidance

Search your Grafana audit logs for dashboard modifications by Editor-level users, especially creation or edit events on TableNG panels. In browser console logs or WAF records, look for JavaScript execution errors or unexpected script loading originating from dashboard domains. Content Security Policy (CSP) headers can help detect XSS attempts if properly configured; enable logging of CSP violations. Examine saved dashboards (via Grafana's API or database queries) for field names containing HTML/JavaScript patterns: script tags, event handlers, or encoded payloads.

Why prioritize this

Although the CVSS score is MEDIUM (6.8), prioritization depends on your Grafana's deployment context. If dashboards are shared across teams or with external stakeholders, or if your Grafana instance holds sensitive operational or security data, treat this as HIGH priority due to high confidentiality impact and the difficulty of detecting stored XSS without active monitoring. If Grafana is isolated to a single trusted team with no sensitive data, MEDIUM priority is appropriate. The lack of KEV designation suggests limited active exploitation, but the attack is trivial to execute for any Editor user aware of the vulnerability.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) is derived from: Attack Vector (Network) = broad accessibility via web; Attack Complexity (Low) = no special conditions required; Privileges Required (Low) = Editor role, a standard privilege tier; User Interaction (Required) = a viewer must visit the malicious dashboard; Scope (Unchanged) = impact is limited to the Grafana application; Confidentiality (High) = session tokens and personal data are exposed; Integrity (Low) = dashboard data can be manipulated but not the underlying system; Availability (Low) = minor disruption possible via JavaScript resource exhaustion. The score appropriately flags this as a notable risk for multi-user deployments while acknowledging the barrier to exploitation.

Frequently asked questions