CVE-2026-88967
Received
Received - Intake
Server-Side Request Forgery in Grafana Azure Monitor Data Source
Vulnerability report for CVE-2026-88967, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: Grafana Labs
Description
Description
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana Enterprise | 10.0.0 |
| Grafana | Grafana Enterprise | 12.0.0 |
| Grafana | Grafana Enterprise | 12.3.0 |
| Grafana | Grafana Enterprise | 12.4.0 |
| Grafana | Grafana Enterprise | 13.0.0 |
| Grafana | Grafana Enterprise | 13.1.0 |
| Grafana | Grafana Enterprise | 13.2.0 |
| Grafana | Grafana OSS | 10.0.0 |
| Grafana | Grafana OSS | 12.0.0 |
| Grafana | Grafana OSS | 12.3.0 |
| Grafana | Grafana OSS | 12.4.0 |
| Grafana | Grafana OSS | 13.0.0 |
| Grafana | Grafana OSS | 13.1.0 |
| Grafana | Grafana OSS | 13.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
