This vulnerability (CVE-2026-9029) in Grafana OSS allows an attacker with Editor permissions to inject a malicious script into the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script is stored and executed in the browsers of users who view the compromised dashboard, constituting a stored cross-site scripting (CWE-79) vulnerability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges of an Editor, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No official patch or remediation level has been provided as of the published date.

Successful exploitation allows an attacker with Editor permissions to execute arbitrary scripts in the browsers of users viewing the affected dashboard. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. The vulnerability requires the attacker to have Editor privileges and user interaction (viewing the dashboard).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor permissions to trusted users only and avoid using untrusted template variables in Geomap panel attribution fields. Monitor vendor communications for updates on patches or official mitigations.