Loading story…
Grafana disclosed a cross-site scripting (XSS) vulnerability in the Geomap MapLibre component of Grafana OSS. Affected versions are 12.3.0 through 12.4.10, 13.0.0 through 13.0.8, 13.1.0 through 13.1.5, and 13.2.0 through 13.2.1.
The Canadian Centre for Cyber Security and Guyana National CIRT advised administrators to review Grafana’s security advisory and apply available updates. The published notices did not specify a CVE identifier, severity rating, exploitation status, technical exploitation details, or the remediated release versions.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-936, warning that Grafana OSS was affected by the Geomap MapLibre XSS issue and directing administrators to review Grafana advisories and apply available updates.
Grafana published a security advisory for a cross-site scripting vulnerability associated with the Geomap MapLibre component. It identified affected Grafana OSS versions 12.3.0–12.4.10, 13.0.0–13.0.8, 13.1.0–13.1.5, and 13.2.0–13.2.1.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grafana Labs released **Grafana 12.4.2** and issued security updates for the **12.3**, **12.2**, **12.1**, and **11.6** release lines to fix two vulnerabilities tracked as **`CVE-2026-27876`** and **`CVE-2026-27880`**. The company described the issues as **critical** and **high severity**, indicating that multiple supported versions were affected and required immediate remediation. Grafana urged users to upgrade to the newly released patched versions as soon as possible to reduce exposure. The advisory was amplified by security community channels, underscoring the urgency for organizations running self-managed Grafana deployments to identify affected instances and apply the vendor fixes promptly.
Jun 29, 2026
Grafana issued urgent patches for two high-severity vulnerabilities, including **`CVE-2026-27876`**, a critical flaw in the SQL Expressions feature that can allow an attacker with **Viewer** privileges or higher to write arbitrary files to the server and potentially escalate to full **remote code execution**. The issue can be chained into broader compromise scenarios, including unauthorized SSH access, prompting public warnings from national defenders such as Belgium’s CCB to patch immediately. Grafana also fixed **`CVE-2026-27880`**, which affects OpenFeature validation endpoints and allows **unauthenticated** attackers to crash vulnerable instances by sending oversized requests that exhaust memory. Grafana Labs said patched releases, including **12.4.2**, are available and noted that **Amazon Managed Grafana** and **Azure Managed Grafana** were already protected under embargo; for temporary mitigation, administrators were advised to disable the `sqlExpressions` feature toggle and use highly available deployments and reverse proxies such as **Nginx** or **Cloudflare** to restrict request sizes.
Jun 29, 2026
German government CERT advisories reported **multiple vulnerabilities in Grafana**, the widely used observability and dashboard platform. Two separate dCERT notices identified Grafana as affected, indicating that security issues were disclosed across more than one advisory rather than as a single isolated flaw. The advisories provide limited public detail, but the repeated notices indicate an ongoing need for organizations running Grafana to review vendor guidance, identify affected versions, and apply available patches or mitigations. Because Grafana is commonly deployed to monitor infrastructure, applications, and security telemetry, unpatched weaknesses could expose sensitive operational data or create opportunities for further compromise depending on the impacted components.
Jun 29, 2026