Medium severity · published Oct 13, 2026
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
8.1.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93294
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93294
vendor-advisory
https://grafana.com/security/security-advisories/cve-2026-93294
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user…
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used