Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 8.1.0 – ≤ 12.3.11, 12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4 | 12.4.13 |
| Grafana | Grafana OSS | 8.1.0 – ≤ 12.3.11, 12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4 | 12.4.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.13-0.1.hum1 | RHSA-2026:85295 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.4-0.1.hum1 | RHSA-2026:85544 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.14-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | No fix yet | — |
Advisories 3
- RHSA-2026:85295 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:85544 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-3910 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 19, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-93294 vendor-advisory