Description
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | (built-in) Google Cloud Monitoring Datasource | 12.4.2 <12.6.7 | — |
| Grafana | Grafana OSS | 13.0.0 <13.0.13 | — |
| Grafana | Grafana OSS | 13.1.0 <13.1.10 | — |
| Grafana | Grafana Enterprise | 0 ≤12.3.11 | — |
| Grafana | Grafana Enterprise | 13.1.0 <13.1.10 | — |
| Grafana | Grafana Enterprise | 12.4.0 <12.4.15 | — |
| Grafana | Grafana OSS | 12.4.0 <12.4.15 | — |
| Grafana | Grafana Enterprise | 13.0.0 <13.0.13 | — |
| Grafana | Grafana OSS | 0 ≤12.3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.5-0.1.hum1 | RHSA-2026:99114 |
Advisories 2
- RHSA-2026:99114 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4568 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026