CVE-2026-93294

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93294", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-09-17T16:21:17.776Z", "datePublished": "2026-10-13T17:05:49.715Z", "dateUpdated": "2026-10-13T19:31:30.245Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "datePublic": "2026-10-13T11:41:03.000Z", "descriptions": [{"lang": "en", "value": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity."}], "metrics": [{"cvssV3_1": {"baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "CWE-441", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-13T17:05:49.715Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-93294"}], "source": {"discovery": "EXTERNAL_REPORT"}, "title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93294", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T17:26:28.085923Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T19:31:30.245Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93294", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-09-17T16:21:17.776Z", "datePublished": "2026-10-13T17:05:49.715Z", "dateUpdated": "2026-10-13T17:05:49.715Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "datePublic": "2026-10-13T11:41:03.000Z", "descriptions": [{"lang": "en", "value": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity."}], "metrics": [{"cvssV3_1": {"baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "CWE-441", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-13T17:05:49.715Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-93294"}], "source": {"discovery": "EXTERNAL_REPORT"}, "title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93294", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T17:26:28.085923Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-13T19:21:26.593Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity."}], "id": "CVE-2026-93294", "lastModified": "2026-10-16T20:02:37.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93294", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T17:26:28.085923Z", "version": "2.0.3"}}]}, "published": "2026-10-13T18:17:26.663", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-93294"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-1220"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Information disclosure via Azure Monitor resource proxy", "id": "2550715", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550715"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source's configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity's permissions."], "name": "CVE-2026-93294", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Out of support scope", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Out of support scope", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-13T17:05:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93294\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93294\nhttps://grafana.com/security/security-advisories/cve-2026-93294"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-10-13T19:45:19.110060+00:00", "updated": "2026-11-10T09:00:15.297811+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}