CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
CVE-2026-93294 is a medium vulnerability (CVSS 6.3) in Grafana Enterprise, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in grafana 12.4.14-r0.
- Severity
- 6.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.27%EPSS, 19th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
12.4.14-r0grafana +4 more
Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
grafanaAlpine:v3.24 | before 12.4.14-r0 | 12.4.14-r0 |
grafanaBitnami | 8.1.0 up to 12.4.13, 13.0.0 up to 13.0.11, 13.1.0 up to 13.1.8, 13.2.0 up to 13.2.4 | 12.4.1313.0.1113.1.813.2.4 |
grafana12.4Red Hat:hummingbird:1 From an advisory covering 3 CVEs | before 0:12.4.13-0.1.hum1 | 0:12.4.13-0.1.hum1 |
grafana13.2Red Hat:hummingbird:1 From an advisory covering 6 CVEs | before 0:13.2.4-0.1.hum1 | 0:13.2.4-0.1.hum1 |
grafana13.1Red Hat:hummingbird:1 From an advisory covering 13 CVEs | before 0:13.1.8-0.3.hum1 | 0:13.1.8-0.3.hum1 |
What each source reports
CVE List Score used
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Record
CVE-2026-93294- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-441, CWE-863, CWE-1220
- Updated
- 2026-11-02
EUVDEUVD-2026-98903
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Record
EUVD-2026-98903- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5wf9-m99g-f6xj
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure...
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Record
GHSA-5wf9-m99g-f6xj- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-441
- Updated
- 2026-11-02
NVD
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Record
CVE-2026-93294- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-441, CWE-863, CWE-1220
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-93294
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Record
ALPINE-CVE-2026-93294- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-04
OSVRHSA-2026:85295
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:85295- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:85544
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:85544- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:87077
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:87077- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVBIT-grafana-2026-93294No score
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Record
BIT-grafana-2026-93294- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
grafana.com/security/security-advisories/cve-2026-93294
nvd.nist.gov/vuln/detail/CVE-2026-93294
github.com/advisories/GHSA-5wf9-m99g-f6xj
security.alpinelinux.org/vuln/CVE-2026-93294
access.redhat.com/errata/RHSA-2026:85295
images.redhat.com
Show 88 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85295.json
bugzilla.redhat.com/show_bug.cgi?id=2556381
cve.org/CVERecord?id=CVE-2026-92539