A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

suse_linux SUSE-SU-2026:4600-1: SUSE SLES15 : Security update for grafana, system-user-grafana (Important) (SUSE-SU-2026:4600-1)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's
    XYZ tile layer via a template variable. The script then executes in the browser of any user who views the
    affected dashboard (stored cross-site scripting). (CVE-2026-9029)

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's     XYZ tile layer via a template variable. The script then executes in the browser of any user who views     the affected dashboard (stored cross-site scripting). (CVE-2026-9029)

  - A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious     field name that executes as a script in the browser of any user who views the dashboard (stored     cross-site scripting). (CVE-2026-8595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's     XYZ tile layer via a template variable. The script then executes in the browser of any user who views the     affected dashboard (stored cross-site scripting). (CVE-2026-9029)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's
    XYZ tile layer via a template variable. The script then executes in the browser of any user who views the
    affected dashboard (stored cross-site scripting). (CVE-2026-9029)

  - A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious
    field name that executes as a script in the browser of any user who views the dashboard (stored cross-site
    scripting). (CVE-2026-8595)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing
    unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of
    service). (CVE-2026-8609)

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source
    plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data
    source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

ID	Name	Product	Family	Type	Severity
465482	Echo: github.com/grafana/grafana: security update to 1.9.2-0.20260616075434-82ef13993059	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465482	Echo: github.com/grafana/grafana: security update to 1.9.2-0.20260616075434-82ef13993059	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
448376	SCA: security update for github.com/grafana/grafana (GHSA-9g84-39mm-q4p3)	Tenable Cloud Security	SCA Checks	Local	medium
448376	SCA: security update for github.com/grafana/grafana (GHSA-9g84-39mm-q4p3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
329320	Grafana Labs 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
322242	Linux Distros Unpatched Vulnerability : CVE-2026-9029	Nessus	Misc.	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-9029

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium