CVE-2026-93294

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

6.3 MediumFix available

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.27%Unchanged since Oct 14, 2026

What each source reports

CVE List Score used 6.3

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Record: CVE-2026-93294
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-441, CWE-863, CWE-1220
Updated: 2026-11-02

EUVDEUVD-2026-98903 6.3

Record: EUVD-2026-98903
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5wf9-m99g-f6xj 6.3

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure...

Record: GHSA-5wf9-m99g-f6xj
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-441
Updated: 2026-11-02

NVD 6.3

Record: CVE-2026-93294
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-441, CWE-863, CWE-1220
Updated: 2026-11-02

OSVALPINE-CVE-2026-93294 6.3

Record: ALPINE-CVE-2026-93294
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-04

OSVRHSA-2026:85295 4.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:85295
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:85544 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:85544
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-grafana-2026-93294 No score

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Record: BIT-grafana-2026-93294
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Alpine:v3.24	before 12.4.14-r0	12.4.14-r0
`grafana` Bitnami	8.1.0 up to 12.4.13, 13.0.0 up to 13.0.11, 13.1.0 up to 13.1.8, 13.2.0 up to 13.2.4	12.4.1313.0.1113.1.813.2.4
`grafana12.4` Red Hat:hummingbird:1	before 0:12.4.13-0.1.hum1	0:12.4.13-0.1.hum1
`grafana13.2` Red Hat:hummingbird:1	before 0:13.2.4-0.1.hum1	0:13.2.4-0.1.hum1

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93294 is a medium vulnerability (CVSS 6.3) in Grafana Enterprise, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in grafana 12.4.14-r0.

References

Show 22 moreShow less