What is the CVSS score of CVE-2026-32117?

CVE-2026-32117 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Grafana are affected by CVE-2026-32117?

The grafanacubism-panel plugin contains a URL validation flaw that could allow attackers to redirect users to malicious sites through dashboard links, potentially leading to credential theft or…

How to fix or mitigate CVE-2026-32117?

Within 24 hours: Audit all Grafana instances to identify cubism-panel plugin installations and document affected systems. Within 7 days: Disable the cubism-panel plugin on all production Grafana instances or restrict dashboard editor access if the plugin is business-critical. Within 30 days: Monitor vendor communications for patch availability and implement immediately upon release; conduct user awareness training on suspicious dashboard links.

Grafana CVE-2026-32117

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 security-advisories@github.com

Grafana XSS Grafanacubism Panel

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 22:16 nvd

HIGH 7.6

DescriptionGitHub Advisory

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.

AnalysisAI

Grafana Cubism Panel versions 0.1.2 and earlier contain a stored cross-site scripting (XSS) vulnerability where dashboard editors can inject malicious javascript: URIs into zoom-link handlers that execute with Grafana origin privileges when viewers interact with the panel. An authenticated attacker with editor permissions can craft a malicious dashboard that executes arbitrary JavaScript in the context of any user who zooms on the affected panel, potentially compromising sensitive data or session tokens.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.