---
id: CVE-2026-76154
title: >-
  A stored cross-site scripting vulnerability in the Geomap panel's MapLibre
  base layer allows a user with the Editor role to execute arbitrary JavaScript
  in another user's session by hosting a malicious style configuration, enabling
  escal…
summary: >-
  A stored cross-site scripting vulnerability in the Geomap panel's MapLibre
  base layer allows a user with the Editor role to execute arbitrary JavaScript
  in another user's session by hosting a malicious style configuration, enabling
  escal…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: Grafana
product: Grafana OSS
affected:
  - oss 12.3.0
  - oss >= 12.4.0 <= 12.4.10
  - oss >= 13.0.0 <= 13.0.8
  - oss >= 13.1.0 <= 13.1.5
  - oss >= 13.2.0 <= 13.2.1
  - enterprise 12.3.0
  - enterprise >= 12.4.0 <= 12.4.10
  - enterprise >= 13.0.0 <= 13.0.8
  - enterprise >= 13.1.0 <= 13.1.5
  - enterprise >= 13.2.0 <= 13.2.1
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:34:36.657'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76154'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-76154'
    label: security@grafana.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76154.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-76154'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528028'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-76154'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76154'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74164'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73655'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76430'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00353
epssPercentile: 0.28751
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:33:54.472083Z'
ingestedAt: '2026-09-17T21:29:16.985Z'
patched:
  - hardened_images
---

## Overview

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:74164** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74164)
- **RHSA-2026:73655** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73655)
- **RHSA-2026:76430** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76430)
- **Red Hat VEX** · Important · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Ceph Storage 7, … · no fix planned: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76154.json)