CVE-2026-93294

Awaiting Analysis Awaiting Analysis - Queue

Azure Resource Manager API Unauthorized Access via Grafana Data Source

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Grafana Labs

Description

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93294

EUVD

EUVD-2026-98903

Affected Vendors & Products

Vendor	Product	Version / Range
Grafana	Grafana	Enterprise 8.1.0
Grafana	Grafana	Enterprise 12.4.0
Grafana	Grafana	Enterprise 13.0.0
Grafana	Grafana	Enterprise 13.1.0
Grafana	Grafana	Enterprise 13.2.0
Grafana	Grafana	OSS 8.1.0
Grafana	Grafana	OSS 12.4.0
Grafana	Grafana	OSS 13.0.0
Grafana	Grafana	OSS 13.1.0
Grafana	Grafana	OSS 13.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-1220	The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

Executive Summary

A user with query access to an Azure Monitor data source in Grafana can misuse its resource proxy to call Azure Resource Manager APIs beyond Grafana's intended scope. This happens because the proxy uses the data source's Azure identity, allowing actions limited only by that identity's permissions.

Detection Guidance

Monitor Azure Monitor data source logs in Grafana for unusual API calls to Azure Resource Manager beyond Grafana's required permissions. Check for queries or requests originating from Grafana that access unauthorized Azure resources.

Impact Analysis

An attacker with query access could perform unauthorized actions in Azure, such as modifying resources or accessing sensitive data, depending on the permissions of the Azure identity used by the data source.

Compliance Impact

The vulnerability could potentially impact compliance with standards like GDPR or HIPAA if the unauthorized API calls expose or modify sensitive data. The impact depends on the Azure role granted to the data source's identity, which determines the scope of unintended actions.

Mitigation Strategies

Update Grafana to the latest patched version. Review and restrict Azure role permissions assigned to the Azure Monitor data source identity. Disable unnecessary proxy access for the data source if not required.

Hi! I’m here to help you understand CVE-2026-93294. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70