All vulnerabilities
CVE-2026-93294

Grafana Enterprise: Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Grafana Grafana EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.4.13Also 13.0.11, 13.1.8 and 1 moreCVE List
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

Text from CVE List

Affected versions 10

  • Grafana Enterpriseaffected: 8.1.0 through 12.3.11CVE List
  • Grafana Enterpriseaffected: 12.4.0 before 12.4.13CVE List
  • Grafana Enterpriseaffected: 13.0.0 before 13.0.11CVE List
  • Grafana Enterpriseaffected: 13.1.0 before 13.1.8CVE List
  • Grafana Enterpriseaffected: 13.2.0 before 13.2.4CVE List
  • Grafana OSSaffected: 8.1.0 through 12.3.11CVE List
  • Grafana OSSaffected: 12.4.0 before 12.4.13CVE List
  • Grafana OSSaffected: 13.0.0 before 13.0.11CVE List
  • Grafana OSSaffected: 13.1.0 before 13.1.8CVE List
  • Grafana OSSaffected: 13.2.0 before 13.2.4CVE List

References 1