CVE-2026-9029: Grafana Geomap Stored XSS via Attribution Field—CVSS 7.3

Technical summary

CVE-2026-9029 is a stored cross-site scripting (XSS) vulnerability in Grafana's Geomap panel. An Editor-level user can embed JavaScript in the attribution field of an XYZ tile layer using template variable syntax. The injected script executes in the browser context of any dashboard viewer, bypassing browser sandbox protections because the code originates from the trusted Grafana domain. The vulnerability requires prior authentication and Editor role assignment, but affects all subsequent viewers regardless of their permissions.

Business impact

This vulnerability creates a lateral privilege escalation and data exfiltration risk within Grafana deployments. An Editor can compromise Viewers, Admins, or other privileged users accessing shared dashboards. Attackers can harvest API tokens, modify data sources, trigger alerts, or pivot to connected systems (databases, cloud platforms, monitoring tools). In multi-tenant or federated Grafana environments, the blast radius extends across business units and integrations.

Affected systems

Grafana instances are affected. The vulnerability requires Editor role or higher to exploit. Geomap panels using XYZ tile layers with template variables in the attribution field are the attack surface. Organizations using Grafana for infrastructure monitoring, observability, or security analytics where dashboards are shared across teams face heightened risk.

Exploitability

Exploitation is straightforward for authenticated users with Editor permissions. No zero-click or authentication bypass is required—the attacker must be invited or assigned Editor access. The attack surface is wide: any Editor can modify any Geomap panel. User interaction is required (the victim must view the dashboard), but this is a normal workflow, making it difficult to detect without behavioral analysis. The CVSS score of 7.3 reflects the authentication requirement and necessary user interaction, balanced against high confidentiality and integrity impact.

Remediation

Apply a Grafana security update that sanitizes user input in Geomap panel attribution fields and enforces strict Content Security Policy (CSP) headers to prevent inline script execution. Verify that template variable expansion does not bypass HTML encoding in this context. Patched versions will be available from Grafana's vendor advisory; monitor your Grafana instance version against the published CVE details.

Patch guidance

Check your Grafana version against the vendor advisory at grafana.com/security. Upgrade to the patched version specified by Grafana. In environments where immediate patching is not feasible, restrict Editor role assignment to trusted administrators and audit existing Geomap panels for suspicious attribution field content. Consider disabling XYZ tile layers temporarily if Geomap functionality is not critical.

Detection guidance

Search Grafana dashboard JSON configurations and database records for suspicious JavaScript or encoded payloads in Geomap panel attribution fields, particularly those containing template variables with unusual syntax. Monitor browser console errors and network requests from Grafana sessions for unexpected script execution. Enable Grafana audit logging to track Editor-level modifications to Geomap panels. Correlate dashboard views with unusual API activity or token usage patterns on affected systems.

Why prioritize this

CVE-2026-9029 should be prioritized if your organization uses Grafana with shared dashboards and a distributed team of Editors. The vulnerability enables account compromise and data theft within a widely-deployed observability platform. While it requires authenticated access, Editor roles are often assigned liberally in DevOps and SRE teams, expanding the threat actor pool. The stored nature of the attack means malicious payloads persist and affect all viewers indefinitely until remediated.

Risk score, explained

The CVSS 7.3 HIGH score reflects: (1) network-accessible target (AV:N); (2) low attack complexity (AC:L)—no special conditions required; (3) low privilege requirement (PR:L)—Editor role is widely held; (4) required user interaction (UI:R)—victims must view the dashboard; (5) unchanged scope (S:U); (6) high confidentiality impact (C:H)—session hijacking, token theft; (7) high integrity impact (I:H)—malicious actions in victim's context; (8) no availability impact (A:N). The score appropriately penalizes the authentication and interaction requirements while recognizing the serious post-exploitation consequences.

Frequently asked questions