Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
GHSA-9g84-39mm-q4p3 · BIT-grafana-2026-9029 · CVE-2026-9029
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9029
- WEB https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
- WEB https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
- WEB https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
- WEB https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58
- PACKAGE https://github.com/grafana/grafana
- WEB https://github.com/grafana/grafana/releases/tag/v12.4.4
- WEB https://github.com/grafana/grafana/releases/tag/v13.0.2
- WEB https://grafana.com/security/security-advisories/cve-2026-9029
Ready to move
Start Securing
Free, no credit card | First findings in minutes