CVE-2026-93294

A moderate information disclosure flaw was found in Grafana, affecting the grafana component as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat Ceph Storage, Red Hat Advanced Cluster Management for Kubernetes, Multicluster Global Hub, and Red Hat In-Vehicle OS, as well as Red Hat Hardened Images and Fedora community builds. An authenticated Grafana user with query access to an Azure Monitor data source can misuse its resource proxy to send requests to Azure Resource Manager APIs beyond those Grafana requires, using the data source's configured cloud identity. This unintended proxying allows an attacker to read sensitive Azure cloud resources within the scope of that identity's permissions, with no impact on integrity or availability. Some RHEL 8 grafana streams are not affected because the vulnerable code is not present. Red Hat rates this flaw 4.3 (Moderate) rather than the upstream 6.3 because the disclosure is bounded by the Azure role granted to the data source identity, resulting in low confidentiality impact with unchanged scope rather than the high confidentiality impact across a changed scope assessed upstream. For the affected Red Hat products the fix is deferred to a future update given the moderate impact and the authentication and query-access prerequisites; the residual risk is that an authenticated user could retrieve Azure resources accessible to the data source identity. For Red Hat Hardened Images and Fedora, a fix is being pursued through those channels.