CVE-2026-8595

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

Score

CVSS 3.1 6.8 Medium

Status

Analyzed - security@grafana.com

Published

2026-07-10

Last modified

2026-10-25

Weaknesses

CWE-79

Affected products

• Grafana (Grafana)
• Grafana Oss (Grafana)

References

• https://grafana.com/security/security-advisories/cve-2026-8595