CVE-2026-93294 — Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Description (CNA)

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana Enterprise	affected 8.1.0 through 12.3.11; affected 12.4.0 before 12.4.13; affected 13.0.0 before 13.0.11; affected 13.1.0 before 13.1.8; affected 13.2.0 before 13.2.4
Grafana / Grafana OSS	affected 8.1.0 through 12.3.11; affected 12.4.0 before 12.4.13; affected 13.0.0 before 13.0.11; affected 13.1.0 before 13.1.8; affected 13.2.0 before 13.2.4

CWE

CWE-441, CWE-863, CWE-1220

References

https://grafana.com/security/security-advisories/cve-2026-93294

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.