Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs (Grafana Grafana Enterprise)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GRAFANA
- NVD status
- Awaiting Analysis
Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Weaknesses (CWE)
- CWE-441 — Unintended Proxy or Intermediary
- CWE-863 — Incorrect Authorization
- CWE-1220 — Insufficient Granularity of Access Control
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N | GRAFANA |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N | NVD · security@grafana.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-98903
- GCVE · GCVE-0-2026-93294
Affected products
| Product | Versions |
|---|---|
| Grafana · Grafana Enterprise | affected 8.1.0 ≤ 12.3.11 ; affected 12.4.0 < 12.4.13 ; affected 13.0.0 < 13.0.11 ; affected 13.1.0 < 13.1.8 ; affected 13.2.0 < 13.2.4 |
| Grafana · Grafana OSS | affected 8.1.0 ≤ 12.3.11 ; affected 12.4.0 < 12.4.13 ; affected 13.0.0 < 13.0.11 ; affected 13.1.0 < 13.1.8 ; affected 13.2.0 < 13.2.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |