Vulnerabilities CVE-2025-41117

CVE-2025-41117

Medium

Open

TLP:CLEAR

XSS in Grafana Explore stack trace

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Details

CVSS Score: 6.8
EPSS Score ⓘ: 0.24%

15.1th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Confidence: 90%
Published: Feb 12, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.