CVE-2025-41117: XSS in Grafana Explore stack trace
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.
Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Grafana Jaeger HTTP datasourcefrom your environment.Uninstall or disable any Jaeger HTTP API datasource in Grafana if it is not required; this eliminates the affected code path in Explore Traces.
- Compensating control
Restrict access to Jaeger HTTP API datasources (network ACLs, firewall rules, or Grafana datasource permissions) and avoid using Jaeger HTTP API datasources in Explore Traces until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41117?
CVE-2025-41117 is considered a high-severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2025-41117?
To mitigate CVE-2025-41117, ensure that you sanitize inputs in stack trace fields and update to the latest version of Grafana that addresses this vulnerability.
Which versions of Grafana are affected by CVE-2025-41117?
CVE-2025-41117 affects all versions of Grafana that allow stack traces to be rendered as raw HTML, particularly those utilizing the Jaeger HTTP API.
What impact does CVE-2025-41117 have on Grafana users?
The impact of CVE-2025-41117 on Grafana users includes the potential for an attacker to execute arbitrary JavaScript in the browser of users viewing affected stack traces.
How can I determine if my Grafana setup is vulnerable to CVE-2025-41117?
To determine if your Grafana setup is vulnerable to CVE-2025-41117, check if you are using affected versions and if your stack traces are improperly managed.