CVE-2026-76154
CVE-2026-76154: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.3
High [CVE-2026-76154] Stored cross-site scripting in the Geomap panel allows privilege escalation
CVE-2026-76154Source published Source updated
Stored cross-site scripting in the Geomap panel allows privilege escalation. Red Hat rates this important (CVSS 7.3). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:74164 with package grafana13-1-main-13.1.6-0.5.hum1, grafana12-4-main-12.4.12-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Enterprise Linux 10; and 3 more.
- Related products — impact not confirmed
- Red Hat Hardened Images
- Multicluster Global Hub
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 10
3 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- grafana13-1-main-13.1.6-0.5.hum1
- grafana12-4-main-12.4.12-0.2.hum1
- RHSA-2026:74164
- Mitigation guidance
- To mitigate this issue, disable the Geomap plugin. This can be achieved by setting `disable_plugins = geomap` in the `[plugins]` section of the `grafana.ini` configuration file, or by setting the environment variable `GF_PLUGINS_DISABLE_PLUGINS=geomap`. A restart of the Grafana service is required for the changes to take effect. Disabling the plugin will remove the Geomap panel and may affect existing dashboards that utilize it.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.