CVE-2025-41117mediumCWE-79

CVE-2025-41117: medium-severity vulnerability in grafana/grafana

XSS in Grafana Explore stack trace

Published · Updated

Follow this CVE+ Monitor grafana/grafana+ Monitor grafana/grafana-enterprise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.3%
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
Grafana · grafana/grafanaGrafana · grafana/grafana-enterprise
Related CVEs — grafana/grafana

In the same product, most dangerous first.

CVE-2026-21721HIGHDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2026-21722MEDIUMPublic Dashboards time range restriction on annotations can be bypassedEPSS 0.4%