This vulnerability (CVE-2026-8595) in Grafana OSS involves a stored cross-site scripting (CWE-79) flaw in the TableNG panel of dashboards. An attacker with Editor permissions can craft a dashboard containing a malicious field name that executes script code in the browser of any user who views the dashboard. The vulnerability impacts versions 12.4.0 and 13.0.0 of Grafana OSS. The CVSS 3.1 base score is 6.8 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L), reflecting network attack vector, low attack complexity, requiring privileges of an Editor, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker with Editor permissions to execute arbitrary scripts in the browsers of users viewing the malicious dashboard. This can lead to high confidentiality impact by exposing sensitive information, low integrity impact by potentially manipulating displayed data, and low availability impact. The attack requires the attacker to have Editor privileges and user interaction (viewing the dashboard).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor permissions to trusted users only and avoid viewing dashboards from untrusted sources. Monitor vendor channels for updates and apply official patches once released.