Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Metrics
CVSS 3.1 6.3/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | >= 8.1.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4 |
| Grafana | Grafana OSS | >= 8.1.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4 |
References
Timeline
- Published
- Oct 13, 2026
- Last modified
- Oct 16, 2026
- NVD status
- Awaiting Analysis