CVE-2025-41117 MEDIUM

CVE-2025-41117: XSS in Grafana Explore stack trace

Vendor Grafana
Product grafana/grafana
Published February 12, 2026
Last update June 12, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Key dates

02Disclosure timeline

February 12, 2026 CVE published
June 12, 2026 Record updated