Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-13T17:05:49 grafana: Grafana: Information disclosure via Azure Monitor resource proxy 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-918

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source's configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity's permissions.

A moderate information disclosure flaw was found in Grafana, affecting the grafana component as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat Ceph Storage, Red Hat Advanced Cluster Management for Kubernetes, Multicluster Global Hub, and Red Hat In-Vehicle OS, as well as Red Hat Hardened Images and Fedora community builds. An authenticated Grafana user with query access to an Azure Monitor data source can misuse its resource proxy to send requests to Azure Resource Manager APIs beyond those Grafana requires, using the data source's configured cloud identity. This unintended proxying allows an attacker to read sensitive Azure cloud resources within the scope of that identity's permissions, with no impact on integrity or availability. Some RHEL 8 grafana streams are not affected because the vulnerable code is not present. Red Hat rates this flaw 4.3 (Moderate) rather than the upstream 6.3 because the disclosure is bounded by the Azure role granted to the data source identity, resulting in low confidentiality impact with unchanged scope rather than the high confidentiality impact across a changed scope assessed upstream. For the affected Red Hat products the fix is deferred to a future update given the moderate impact and the authentication and query-access prerequisites; the residual risk is that an authenticated user could retrieve Azure resources accessible to the data source identity. For Red Hat Hardened Images and Fedora, a fix is being pursued through those channels. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-10-19T00:00:00Z RHSA-2026:85295 grafana12-4-main-12.4.13-0.1.hum1 Red Hat Hardened Images 2026-10-19T00:00:00Z RHSA-2026:85544 grafana13-2-main-13.2.4-0.1.hum1 Red Hat Hardened Images 2026-10-21T00:00:00Z RHSA-2026:87077 grafana13-1-main-13.1.8-0.3.hum1 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-grafana-rhel9 Red Hat Ceph Storage 7 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Out of support scope rhceph/grafana-rhel10 Red Hat Enterprise Linux 10 Fix deferred grafana Red Hat Enterprise Linux 10 Fix deferred rhel10/grafana Red Hat Enterprise Linux 8 Fix deferred grafana Red Hat Enterprise Linux 9 Fix deferred grafana Red Hat Enterprise Linux 9 Fix deferred rhel9/grafana Red Hat Hardened Images Not affected hi/grafana https://www.cve.org/CVERecord?id=CVE-2026-93294 https://nvd.nist.gov/vuln/detail/CVE-2026-93294 https://grafana.com/security/security-advisories/cve-2026-93294