CVE-2026-76154: Grafana Geomap: stored XSS enables Org Admin escalation

HIGH

Published September 17, 2026

CISO Take

CVE-2026-76154 is a stored cross-site scripting flaw in Grafana's Geomap panel (MapLibre base layer) that lets a user with the Editor role point a panel at an attacker-hosted style configuration and run JavaScript in another user's session, including an Org Admin's. Exploitation requires an authenticated Editor and a victim who views the panel. The EPSS score of 0.35% (73rd percentile), no public exploit, no Nuclei template, no KEV listing and a CISA SSVC decision of TRACK all point to low near-term exploitation pressure. The risk is still real for shared Grafana instances that monitor ML pipelines, model serving or GPU fleets, because a hijacked admin session exposes data sources, API keys and dashboards. Apply the fixed Grafana release listed in the vendor advisory (grafana.com/security/security-advisories/cve-2026-76154). Until then, restrict the Editor role, review Geomap panels for external style URLs, and use CSP to block untrusted style and script sources.

Sources:NVDEPSSgrafana.comATLAS

What is the risk?

Rated High by CVSS (7.3), but practical risk is moderate. The attack is network-based with low complexity, but it needs an authenticated Editor account (PR:L) and victim interaction (UI:R). EPSS is low (0.00353, 73rd percentile), there is no public exploit or scanner template, and the CVE is not in CISA KEV (SSVC: TRACK). Confidentiality and integrity impact are both high because the injected script runs in the victim's authenticated session. The main risk is privilege escalation from Editor to Org Admin on multi-tenant or broadly shared observability instances. Confidence: MEDIUM, because the affected-version data is incomplete and the package is not mapped to our tracked catalog.

How does the attack unfold?

Initial Access

Attacker uses a valid Editor account on the Grafana instance.

AML.T0012

Payload Staging

Attacker sets the Geomap MapLibre base layer to a malicious style configuration hosted on an attacker-controlled server.

AML.T0079

Exploitation

A victim, such as an Org Admin, opens the dashboard and the stored XSS payload runs in their session.

AML.T0011.003

Impact

Attacker escalates to Org Admin and gains access to data sources, API tokens and dashboards covering AI/ML infrastructure.

Initial Access

Attacker uses a valid Editor account on the Grafana instance.

AML.T0012

Payload Staging

Attacker sets the Geomap MapLibre base layer to a malicious style configuration hosted on an attacker-controlled server.

AML.T0079

Exploitation

A victim, such as an Org Admin, opens the dashboard and the stored XSS payload runs in their session.

AML.T0011.003

Impact

Attacker escalates to Org Admin and gains access to data sources, API tokens and dashboards covering AI/ML infrastructure.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

7 steps

Upgrade Grafana to the patched version named in the vendor advisory (https://grafana.com/security/security-advisories/cve-2026-76154).
Until patched, limit the Editor role to trusted users and review who can create or edit Geomap panels.
Audit existing dashboards for Geomap panels whose MapLibre base layer references external or unexpected style URLs.
Apply a strict Content-Security-Policy that blocks inline scripts and untrusted style sources.
Rotate API keys, service account tokens and data source credentials if suspicious panel edits are found.
Monitor audit logs for panel changes by Editors, new admin role assignments and new service accounts.
Remove anonymous or shared-link access to affected dashboards.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassFrameworkAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage security incidents

Frequently Asked Questions

What is CVE-2026-76154?

Is CVE-2026-76154 actively exploited?

No confirmed active exploitation of CVE-2026-76154 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-76154?

1. Upgrade Grafana to the patched version named in the vendor advisory (https://grafana.com/security/security-advisories/cve-2026-76154). 2. Until patched, limit the Editor role to trusted users and review who can create or edit Geomap panels. 3. Audit existing dashboards for Geomap panels whose MapLibre base layer references external or unexpected style URLs. 4. Apply a strict Content-Security-Policy that blocks inline scripts and untrusted style sources. 5. Rotate API keys, service account tokens and data source credentials if suspicious panel edits are found. 6. Monitor audit logs for panel changes by Editors, new admin role assignments and new service accounts. 7. Remove anonymous or shared-link access to affected dashboards.

What systems are affected by CVE-2026-76154?

This vulnerability affects the following AI/ML architecture patterns: ML observability dashboards, Model serving monitoring, Training pipeline monitoring, MLOps platforms.

What is the CVSS score for CVE-2026-76154?

CVE-2026-76154 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

ML observability dashboardsModel serving monitoringTraining pipeline monitoringMLOps platforms

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Exploitation Scenario

An attacker with an Editor account on a shared Grafana instance used by an ML platform team edits a Geomap panel on an inference-fleet dashboard. They set the MapLibre base layer to a style configuration hosted on their own server, containing a malicious payload. When an Org Admin opens the dashboard, the script runs in the admin's browser session. It creates a new Admin-level service account and token and reads data source credentials. The attacker then uses that access to reach metrics and logs from AI training and serving systems, and may use the exposed credentials to move to adjacent infrastructure.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.