What’s Vulnerable › Vulnerabilities
CVE-2026-93294: Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-13 · updated 2026-10-16
- Weakness: CWE-441
Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Affected products
- Grafana: from 8.1.0 through 12.3.11; from 12.4.0 before 12.4.13; from 13.0.0 before 13.0.11; from 13.1.0 before 13.1.8; from 13.2.0 before 13.2.4 — fixed in 12.4.13, 13.0.11, 13.1.8, 13.2.4
How to fix
Upgrade to a fixed version: Grafana 12.4.13, 13.0.11, 13.1.8, 13.2.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-93294 or the next vulnerability affects your stack