Is CVE-2025-41117 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-41117 being exploited in the wild.

How severe is CVE-2025-41117?

Medium severity, with a CVSS score of 6.8, published 12 February 2026.

Which products and versions are affected?

github.com/grafana/grafana (Go) SEMVER:introduced=0, SEMVER:introduced=12.2.0,fixed=12.2.5.

Is there a fix for CVE-2025-41117?

Yes. github.com/grafana/grafana (Go): upgrade to 12.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-41117 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-41117?

Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-41117: Grafana XSS in Explore Traces view via Jaeger HTTP API

CVE-2025-41117 · Severity: medium · CVSS 6.8 · Published 2026-02-12

Grafana, a popular data visualization and monitoring platform, is vulnerable to a security flaw in its trace viewing component. Malicious code hidden within system error logs (stack traces) can be executed in a user's browser when they view specific data from Jaeger HTTP sources. This could allow an attacker to steal session information or perform unauthorized actions on behalf of the user.

Technologies: github.com/grafana/grafana (Go). Vendors: Go.

Quick answers

Is CVE-2025-41117 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-41117 being exploited in the wild.
How severe is CVE-2025-41117?: Medium severity, with a CVSS score of 6.8, published 12 February 2026.
Which products and versions are affected?: github.com/grafana/grafana (Go) SEMVER:introduced=0, SEMVER:introduced=12.2.0,fixed=12.2.5.
Is there a fix for CVE-2025-41117?: Yes. github.com/grafana/grafana (Go): upgrade to 12.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-41117 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-41117?: Check whether you run github.com/grafana/grafana (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/grafana/grafana (Go): upgrade to 12.2.5 or later
```
go get github.com/grafana/grafana@v12.2.5
```

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Grafana's TraceView component. The root cause is the improper neutralization of input in the 'KeyValuesTable' component, where stack traces from Jaeger HTTP API data sources are rendered as raw HTML instead of sanitized text. An attacker can exploit this by injecting malicious JavaScript into a stack trace field within a Jaeger-compatible data source. When a victim views the affected trace in the Explore Traces view, the script executes in their browser. The vulnerability is mitigated by the requirement for specific data source configurations (Jaeger HTTP API) and user interaction to view the malicious trace. Patches have been released in versions 12.2.5 and 12.3.3 which implement DOMPurify for HTML sanitization.

Affected products

Grafana Labs Grafana >= 12.2.0, < 12.2.5; >= 12.3.0, < 12.3.3

Identifiers

CVE-2025-41117
GHSA-cqp7-wf4c-3xgc
GO-2026-5332

Timeline

2026-02-12: disclosed
2026-02-12: advisory
2026-05-11: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.