CVE-2026-8595: Stored XSS in the table panel (TableNG)
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/grafanato a version that resolves this vulnerability.Fixed in 12.4.4-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8595?
The severity of CVE-2026-8595 is classified as medium with a score of 6.8.
What type of vulnerability is CVE-2026-8595?
CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-8595?
A user with Editor permissions can exploit CVE-2026-8595 by crafting a malicious dashboard.
What impact does CVE-2026-8595 have on users?
CVE-2026-8595 allows an attacker to execute scripts in the browser of any user who views the compromised dashboard.
How do I fix CVE-2026-8595?
To fix CVE-2026-8595, users should ensure that they are using the latest version of the software with security patches that address this vulnerability.