CVE-2026-76154

CVE-2026-76154 CVE Record

7.3 HighFix available

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.35%Unchanged since Sep 18, 2026

What each source reports

CVE List Score used 7.3

CVE-2026-76154 CVE Record

Record: CVE-2026-76154
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2026-82430 7.3

Record: EUVD-2026-82430
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-35gc-393c-vjxf 7.3

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a...

Record: GHSA-35gc-393c-vjxf
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 7.3

Record: CVE-2026-76154
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2026-76154 7.3

Record: ALPINE-CVE-2026-76154
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated: 2026-11-04

OSVRHSA-2026:73655 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:73655
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Show 4 moreShow less

OSVRHSA-2026:74164 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:74164
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2026:76430 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76430
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-grafana-2026-76154 No score

CVE-2026-76154 CVE Record

Record: BIT-grafana-2026-76154
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11920-1 No score

grafana-12.4.11-1.1 on GA media

These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11920-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Alpine:v3.24	before 12.4.14-r0	12.4.14-r0
`grafana` Bitnami	12.3.0 up to 12.3.1, 12.4.0 up to 12.4.11, 13.0.0 up to 13.0.9, 13.1.0 up to 13.1.6, 13.2.0 up to 13.2.2	12.3.112.4.1113.0.913.1.613.2.2
`grafana13.1` Red Hat:hummingbird:1	before 0:13.1.6-0.5.hum1	0:13.1.6-0.5.hum1
`grafana12.4` Red Hat:hummingbird:1	before 0:12.4.12-0.2.hum1	0:12.4.12-0.2.hum1
`grafana13.2` Red Hat:hummingbird:1	before 0:13.2.3-0.1.hum1	0:13.2.3-0.1.hum1
`grafana` openSUSE:Tumbleweed	before 12.4.11-1.1	12.4.11-1.1

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-76154 is a high vulnerability (CVSS 7.3) in Grafana Oss, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in grafana 12.4.14-r0.

References

Show 79 moreShow less