CVE-2026-8595

{
  "id": "CVE-2026-8595",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-10T16:16:39.400",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting)."
    },
    {
      "lang": "es",
      "value": "Un usuario con permisos de Editor puede crear un panel de control cuyo panel de tabla (TableNG) contiene un nombre de campo malicioso que se ejecuta como un script en el navegador de cualquier usuario que ve el panel de control (cross-site scripting almacenado)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana OSS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "12.4.0",
              "lessThanOrEqual": "12.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "13.0.0",
              "lessThanOrEqual": "13.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 4.7
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T15:59:08.422134Z",
          "id": "CVE-2026-8595",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "12.4.0",
              "versionEndExcluding": "12.4.4",
              "matchCriteriaId": "F820291A-C1C6-4DBC-8064-6133F16547C4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "13.0.0",
              "versionEndExcluding": "13.0.2",
              "matchCriteriaId": "643002A3-545F-4605-AAAF-EF55C5B14392"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-8595",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}