Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Published: 2026-10-13
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Assess Impact
AI Analysis

Impact

The vulnerability arises when a user who has query access to an Azure Monitor data source in Grafana can misuse the data source's resource proxy to send arbitrary requests to Azure Resource Manager APIs. The proxy performs the calls using the data source's Azure identity, effectively bypassing the intended API restrictions. The impact is dependent on the permissions granted to that identity; a privileged role could allow reading or modifying resources across a subscription. It maps to multiple CWE identifiers, including CWE-918.

Affected Systems

All Grafana Enterprise and Grafana OSS deployments that configure an Azure Monitor data source are affected. No specific product version information is listed in the advisory, so any installation that has the data source provisioned may be vulnerable. Users should examine whether their Grafana instances expose a data source with Azure identity integration.

Risk and Exploitability

The CVSS v3 score of 6.3 marks it as a moderate severity issue. The EPSS score is < 1%, so the likelihood of exploitation remains low. The vulnerability is not listed in CISA's KEV catalog. The attack vector appears to be through a legitimate query user who can craft dashboard queries to invoke the proxy. Once exploited, the attacker can execute any ARM API supported by the identity, which could lead to disclosure or modification of resources.

Generated by OpenCVE AI on October 17, 2026 at 06:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Review the Azure role assigned to the Grafana Azure Monitor data source identity and remove any permissions that are not required for Grafana's operation.
  • Apply the principle of least privilege by restricting query access to the data source to only trusted users and disabling unnecessary query functionality.
  • Monitor outbound Azure Resource Manager API calls originating from Grafana to detect suspicious activity and enforce rate limiting if appropriate.

Generated by OpenCVE AI on October 17, 2026 at 06:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-918
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 13 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Title Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
Weaknesses CWE-1220
CWE-441
CWE-863
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-10-13T19:31:30.245Z

Reserved: 2026-09-17T16:21:17.776Z

Link: CVE-2026-93294

cve-icon Vulnrichment

Updated: 2026-10-13T19:21:26.593Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T18:17:26.663

Modified: 2026-10-16T20:02:37.630

Link: CVE-2026-93294

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-13T17:05:49Z

Links: CVE-2026-93294 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T06:30:05Z

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')

  • CWE-863

    Incorrect Authorization

  • CWE-918

    Server-Side Request Forgery (SSRF)