What is CVE-2026-9029?

CVE-2026-9029 is a security advisory published by Grafana Labs Security. Stored XSS in the Geomap panel tile-layer attribution

Why does CVE-2026-9029 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

CVE-2026-9029Disclosed before NVD

Stored XSS in the Geomap panel tile-layer attribution

Vendor

Grafana Labs Security

Published

June 9, 2026

Last Modified

—

📋 Description

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel’s XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting). Upgrade to a fixed version listed below.

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-9029/