CVE-2026-76154

Executive Summary

CVE-2026-76154 is a stored cross-site scripting (XSS) vulnerability in the Geomap panel's MapLibre base layer, where a malicious map style configuration hosted by an attacker persists in application state and executes arbitrary JavaScript in the session of any other user who views the affected dashboard. The flaw requires only the Editor role to implant the payload, making it reachable by a broad set of non-privileged dashboard authors, but it executes in the context of higher-privileged viewers — the NVD description explicitly notes escalation to Org Admin as an outcome. With a CVSS base score of 7.3 (High), no vendor patch, no public PoC, no Nuclei template, and no EPSS score yet assigned, defenders must treat this as an unpatched, unmitigated risk requiring compensating controls.

Technical Analysis

CVE-2026-76154 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting), specifically the stored (persistent) subtype. The vulnerable component is the Geomap panel, and the injection point is the MapLibre base layer's style configuration.

The mechanism, as described in the NVD entry, is as follows:

1. The Geomap panel renders map tiles/vectors using MapLibre, a client-side map rendering library. MapLibre consumes a declarative style configuration document that defines sources, layers, colors, glyphs, sprites, and similar rendering directives.
2. The style configuration is supplied by a user (the Editor) and, critically, can reference a remote/external style document — i.e., an attacker-controlled URL hosting the malicious style. This is the "hosting a malicious style configuration" language in the description.
3. Because the style configuration is stored (persisted as part of the dashboard/panel definition rather than supplied per-request by the victim), it is rendered for every subsequent viewer of the dashboard. This is what makes the vulnerability persistent rather than reflected.
4. When a victim opens the dashboard, their browser fetches and applies the style. If the style configuration contains script-bearing content that the Geomap panel fails to sanitize, that JavaScript executes in the victim's session and origin context.

The exact sanitization failure — whether it is a missing CSP on the map rendering surface, an unescaped string interpolated into a style expression (MapLibre expressions can invoke functions), or an SVG/glyph URL that resolves to javascript: — is not specified in the available intelligence. Per accuracy constraints, we do not invent the precise sink. What is certain is the class: a stored XSS requiring Editor-level write access and executing with at least the read/write privileges of the viewer, who may be an Org Admin.

Attack surface: any deployment where the Geomap panel is available and where dashboards can be created or edited by users holding the Editor role. The trust boundary is violated because Editor is conventionally considered a content-authoring role, not a role that should be able to achieve script execution against administrators.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-76154. The attack chain below is inferred from the vulnerability class (stored XSS via configurable rendering component) and the specific facts stated in the NVD description (Geomap panel, MapLibre base layer, malicious hosted style, Editor-to-Org-Admin escalation). We do not fabricate function names, endpoints, or parameter names.

Step 1 — Reconnaissance / target identification. The attacker requires authenticated access with the Editor role. They enumerate dashboards containing (or capable of containing) a Geomap panel, and identify which dashboards are likely viewed by higher-privileged users (e.g., operational/executive dashboards, org-wide home dashboards, or shared folders visible to Admins). The attacker also provisions external hosting for the malicious style configuration — any attacker-controlled web host is sufficient, since the vulnerability is triggered by the content of the hosted style once fetched by the panel.

Step 2 — Triggering the flaw class. The attacker creates or edits a Geomap panel and configures the MapLibre base layer to use a style configuration that points to, or embeds, attacker-controlled content. Because the affected component persists this configuration as part of the panel definition (stored), the malicious style becomes part of the dashboard artifact.

Step 3 — Payload / execution. When any other user — including an Org Admin — opens the dashboard, their browser loads the panel, MapLibre consumes the attacker's style configuration, and the script-bearing content executes in the victim's session and origin. The NVD description frames this as "execute arbitrary JavaScript in another user's session." At the vulnerability-class level, the payload's objective is to act as the victim: read data visible to the victim, and issue authenticated requests as the victim.

Step 4 — Post-exploitation impact. The description explicitly names escalation to Org Admin as the outcome. The plausible mechanism, given stored XSS in an authenticated web application, is that the injected JavaScript runs with the victim's session cookies/CSRF context and performs privileged actions on the victim's behalf — including, if the victim is already an Org Admin, actions limited to Org Admin (e.g., granting the attacker's account elevated privileges, creating admin tokens, or modifying org settings). Note: the exact escalation primitive is not described in the available intelligence and should not be assumed beyond "script execution in the Org Admin's session enables Org Admin-level actions."

Prerequisite summary: Editor role (to author the malicious style) + victim interaction (viewing the poisoned dashboard) → script execution in victim session → potential Org Admin escalation.

Impact Assessment

Confidentiality: High (C:H). Arbitrary JavaScript in a privileged viewer's session can read any data that viewer can access, including dashboards, data sources, alert rules, and org settings. In an observability platform, this may include credentials embedded in data source configurations.

Integrity: High (I:H). The executing script can perform authenticated state-changing operations as the victim. With an Org Admin victim, this includes administrative changes to the organization.

Availability: None (A:N). The vector declares no availability impact, consistent with a client-side script-injection class that does not directly destroy or deny service to data.

Exploitability sub-score: AV:N (network-reachable web application), AC:L (no special conditions are described), PR:L (Editor role required — low privileges, not none), UI:R (a victim must view the poisoned dashboard). The UI:R requirement is the primary restraint on the score, which is why the vector yields 7.3 rather than a Critical rating.

Scope: Unchanged (S:U) — impact is confined to the vulnerable application's authority, though functionally it crosses a privilege boundary (Editor → Admin) within that same authority.

Blast radius. Any user who views an affected dashboard. The most severe single-victim outcome is compromise of an Org Admin session. Multi-tenant or shared-dashboard deployments widen exposure, since a single poisoned dashboard can be viewed by many users across teams. No affected version list was provided, so the population of vulnerable deployments cannot be scoped; assume all versions exposing the Geomap panel with MapLibre base layer configuration are candidates until the vendor clarifies.

Business impact. Because it is unpatched (0/4 patch confidence), organizations cannot close the exposure by upgrading. The realistic business risks are: (1) unauthorized administrative changes to observability/org configuration, (2) credential or sensitive-dashboard data exfiltration via a trusted internal user session, and (3) lateral movement if the platform holds credentials to downstream systems (common in data-source configurations).

Detection Guidance

Detection for this CVE is challenging because it is a client-side stored XSS where the malicious artifact (a style configuration) may be legitimate-looking and fetched from an arbitrary external host. Detection must therefore focus on outbound requests to external map-style hosts and on anomalous panel-configuration changes. No vendor-provided signatures exist.

Sigma Rule

title: Potential Stored XSS via Geomap Panel MapLibre Base Layer Style Config
id: 8f3c1a92-6b2e-4f77-9d1a-76154cve0001
status: experimental
description: Detects configuration or URL patterns consistent with a malicious MapLibre base-layer style reference in a Geomap panel, associated with CVE-2026-76154.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76154
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
  category: web
  product: generic
detection:
  selection_style:
    c-uri|contains:
      - 'style.json'
      - 'maplibre'
      - 'style'
  selection_suspicious:
    c-uri|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection_style and selection_suspicious
falsepositives:
  - Legitimate documentation or test dashboards referencing MapLibre examples
level: medium
tags:
  - attack.t1059.007
  - cve.2026.76154

Note: this rule is heuristic. The authoritative detection artifact for this CVE is the panel/style configuration record itself; log pipelines that capture dashboard-definition change events should alert on Editor-role users adding external style URLs to Geomap panels.

YARA Rule

rule CVE_2026_76154_Geomap_MapLibre_Style_XSS
{
    meta:
        description = "Detects MapLibre style configurations containing script-bearing content consistent with stored XSS (CVE-2026-76154)"
        author = "ValtersIT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76154"
        date = "2026-01-01"
        cve = "CVE-2026-76154"

    strings:
        $maplibre = "maplibre" ascii nocase
        $style    = "style.json" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "&#x3C;script" ascii nocase

    condition:
        (uint16(0) == 0x7B7B or $style) and
        ($maplibre or $style) and
        any of ($s*)
}

Note: this scans style/panel artifacts on disk or in object storage. It will not catch payloads encoded in a way not listed; treat it as a starting point and extend string coverage as samples are collected. No public sample of the malicious style exists, so the $s* strings reflect generic XSS-in-config indicators rather than a confirmed signature.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76154 Possible Geomap/MapLibre Malicious Style Request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"style"; http.uri; content:"json"; http.uri; pcre:"/(%3Cscript|<script|javascript%3A|javascript:)/iU"; classtype:web-application-attack; reference:cve,2026-76154; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76154; sid:202676154; rev:1;)

Note: because the malicious style is hosted externally by the attacker, this rule is most effective when deployed on egress and internal-to-internal boundaries to catch servers fetching attacker-hosted styles containing inline script. Adjust the classtype and sid to local conventions.

Elastic Detection

sequence by host.name with maxspan=10m
  [ network where network.protocol == "http" and url.path : "*style*" and url.path : "*.json*" ]
  [ network where network.protocol == "http" and
      (url.full : "*<script*" or url.full : "*javascript:*" or
       url.query : "*onerror=*" or url.query : "*onload=*") ]

process where event.type == "start" and
  process.name : ("grafana-server", "grafana")
  and process.args : "*geomap*"

Splunk SPL Query

index=web OR index=proxy
| eval u = lower(uri)
| where match(u, "style") AND (match(u, "%3cscript|<script|javascript%3a|javascript:|onerror=|onload="))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as src_ips values(dest) as destinations
        by uri, user_agent
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

For panel-configuration change detection (recommended, since this is stored XSS):

index=grafana sourcetype=grafana:audit
| search action="update" AND resource="dashboard" AND message="*geomap*"
| table _time, user, action, resource, message
| sort - _time

Note: index/sourcetype names must be adapted to each environment. The audit-log search is the higher-fidelity detection because the trigger is a configuration write by an Editor.

Wazuh OSSEC Rule

<group name="web,grafana,cve-2026-76154,">
  <rule id="100761" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri">\.json</field>
    <field name="uri">style</field>
    <regex type="pcre2">(?i)(%3Cscript|<script|javascript%3A|javascript:)</regex>
    <description>CVE-2026-76154: Possible Geomap/MapLibre malicious style configuration request</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_76154,xss,</group>
  </rule>

  <rule id="100762" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">update</field>
    <field name="resource">dashboard</field>
    <regex type="pcre2">(?i)geomap</regex>
    <description>CVE-2026-76154: Dashboard with Geomap panel modified - review for malicious MapLibre base layer style</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_76154,xss,</group>
  </rule>
</group>

Note: rule 100762 targets the audit event that constitutes the actual attack trigger and is the higher-value detection. Field names (action, resource, uri) must be mapped to your actual decoder output.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. No vendor fix, no workaround, and no affected version list are available. The following are compensating controls, not fixes.

1) Immediate mitigations (deploy now):

• Restrict style sources via Content Security Policy. If the deployment allows injecting a CSP header for the web UI, add connect-src/img-src/style-src directives that allow only trusted, explicitly-listed map style hosts. This removes the attacker's ability to reach an arbitrary external style host from the victim's browser.
• Reduce Editor privileges. Because the flaw requires only Editor, audit who holds Editor and remove it from users who do not need dashboard-authoring rights. Enforce least privilege on dashboard folders.
• Disable or restrict the Geomap panel / MapLibre base layer for non-administrator authors until a fix lands. If the platform permits feature toggling, disabling external style URLs is the most direct control.
• Monitor dashboard definitions for external style URLs. Alert on any Geomap panel whose base layer points to an off-domain host. Treat Editor-initiated additions of external style endpoints as a security event (see Wazuh rule 100762 and the Splunk audit query).
• Require MFA and short session lifetimes for Org Admins to reduce the value of a stolen/abused admin session.

2) Patch/upgrade steps:

• No patch exists as of this report. Monitor the vendor's security advisories and CVE-2026-76154's NVD record for an official fixed release. When available, upgrade immediately and verify that the Geomap/MapLibre style-sanitization path is corrected. Do not rely on version numbers inferred from this report — none are confirmed.

3) Long-term hardening:

• Adopt a strict CSP with nonce/hash-based script allowlisting across the whole web UI; stored XSS in a first-party component is dramatically harder to exploit when inline script and arbitrary external script sources are blocked.
• Implement server-side validation/sanitization of panel JSON, specifically rejecting dangerous URL schemes and inline markup in map style references.
• Separate content-authoring roles from administrative roles across the platform, and require a second approval for dashboard changes visible to privileged viewers.
• Ingest audit logs into the SIEM with alerting on role changes and privileged dashboard edits (T1059.007-adjacent detection).
• Track CVE-2026-76154 in vulnerability management and re-evaluate automatically when a patch or EPSS score publishes.

References

1. NVD — CVE-2026-76154: https://nvd.nist.gov/vuln/detail/CVE-2026-76154 (authoritative record; note the record at publication lacks an affected-version list and a CNA title)
2. MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
4. OWASP — Cross Site Scripting (XSS) Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
5. MapLibre Style Specification (context for the base-layer style configuration surface): https://maplibre.org/maplibre-style-spec/

Exploit-in-the-wild / campaign evidence: None available. CISA KEV status is NO; there is no public PoC, no exploit code, and no Nuclei template. EPSS has not yet scored this CVE. No threat-actor campaign is associated with CVE-2026-76154 in the available intelligence. Any claim of active exploitation would be unsupported and should be treated as unverified until vendor or FIRST/KEV data confirms it.