CVE-2026-106472

MediumCVSS 6.3/10Last modified Nov 12, 2026

Description

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Grafana	Grafana OSS	>= 9.1.0, <= 11.6.16; >= 12.0.0, <= 12.2.10; >= 12.3.0, <= 12.3.11; >= 12.4.0, < 12.4.15; >= 13.0.0, < 13.0.13; >= 13.1.0, < 13.1.10
Grafana	Grafana Enterprise	>= 9.1.0, <= 11.6.16; >= 12.0.0, <= 12.2.10; >= 12.3.0, <= 12.3.11; >= 12.4.0, < 12.4.15; >= 13.0.0, < 13.0.13; >= 13.1.0, < 13.1.10
Grafana	Prometheus Datasource	>= 13.1.1, <= 13.1.9; >= 13.2.0, < 13.2.6

References

https://grafana.com/security/security-advisories/cve-2026-106472

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1064757.1The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, CVE-2026-106485.5mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() bef CVE-2026-1064844.4Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrar CVE-2026-1064869.9Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-clou CVE-2026-1064875.0Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affecte CVE-2026-1064888.1Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider pack CVE-2026-1064896.5Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by CVE-2026-106498.6A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decomp CVE-2026-1064906.5Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by CVE-2026-1064916.4Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by i CVE-2026-1064926.5Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affect CVE-2026-1064934.1Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validat