BIT-grafana-2026-93294

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-93294.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-grafana-2026-93294

Aliases

CVE-2026-93294

Published

2026-10-20T08:45:18Z

Modified

2026-10-20T10:30:05Z

Summary

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Details

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:go:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

8.1.0

Fixed

12.4.13

Introduced

13.0.0

Fixed

13.0.11

Introduced

13.1.0

Fixed

13.1.8

Introduced

13.2.0

Fixed

13.2.4

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-93294.json"