CVE-2026-93294
published 2026-10-13CVE-2026-93294: A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the…
PriorityP338medium6.3CVSS 3.1
AVNACHPRLUINSCCHINAN
EPSS
0.27%
17.6th percentile
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.4 | 13.2.4 |
| grafana | grafana_enterprise | 8.1.0 – 12.3.11 | — |
| grafana | grafana_oss | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.4 | 13.2.4 |
| grafana | grafana_oss | 8.1.0 – 12.3.11 | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: Grafana: Information disclosure via Azure Monitor resource proxy
vendor_redhat·2026-10-13·CVSS 6.3
CVE-2026-93294 [MEDIUM] CWE-918 grafana: Grafana: Information disclosure via Azure Monitor resource proxy
grafana: Grafana: Information disclosure via Azure Monitor resource proxy
A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source's configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity's permissions.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 7) - Fix d
GHSA
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended pr
ghsa_unreviewed·2026-10-13
CVE-2026-93294 [MEDIUM] CWE-441 A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended pr
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93294 grafana: Grafana: Information disclosure via Azure Monitor resource proxy [fedora-all]
bugzilla·2026-10-15·CVSS 6.3
CVE-2026-93294 [MEDIUM] CVE-2026-93294 grafana: Grafana: Information disclosure via Azure Monitor resource proxy [fedora-all]
CVE-2026-93294 grafana: Grafana: Information disclosure via Azure Monitor resource proxy [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Bugzilla
CVE-2026-93294 grafana: Grafana: Information disclosure via Azure Monitor resource proxy
bugzilla·2026-10-13·CVSS 6.3
CVE-2026-93294 [MEDIUM] CVE-2026-93294 grafana: Grafana: Information disclosure via Azure Monitor resource proxy
CVE-2026-93294 grafana: Grafana: Information disclosure via Azure Monitor resource proxy
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
2026-10-13
Published