PT-2026-3005 · Grafana · Grafana-Image-Renderer+1

Published 2026-01-15 · Updated 2026-01-20 · CVE-2026-22638

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description A cross-site scripting (XSS) issue exists in Grafana due to a combination of client path traversal and open redirect. This allows attackers to redirect users to a website hosting a frontend plugin capable of executing arbitrary JavaScript. The issue does not require editor permissions and is exploitable even with anonymous access enabled. If the Grafana Image Renderer plugin is installed, the open redirect can lead to a full read Server-Side Request Forgery (SSRF). The default Content-Security-Policy (CSP) in Grafana may block the XSS through the connect-src directive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2026-00578

CVE-2026-22638

Affected Products

Grafana

Grafana-Image-Renderer

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-22638 · Security Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00578 · Security Note
• https://twitter.com/CVEnew/status/2012490364406423753 · Twitter Post
• https://twitter.com/cracbot/status/2013567229993066955 · Twitter Post
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.json · Note
• https://first.org/cvss/calculator/3.1 · Note
• https://twitter.com/TheHackerWire/status/2011811228994142514 · Twitter Post
• https://sick.com/psirt · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note