CVE-2026-93294: Grafana Azure Monitor Data Source Proxy Vulnerability
Summary
CVE-2026-93294: Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs. Affects grafana across 4 version ranges.
>= 8.1.0, < 12.4.13
>= 13.0.0, < 13.0.11
>= 13.1.0, < 13.1.8
>= 13.2.0, < 13.2.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources. It provides a rich set of features for creating dashboards and alerts, making it a popular choice for monitoring applications and infrastructure. The Azure Monitor data source in Grafana enables users to connect to Azure services and retrieve metrics and logs. However, a vulnerability has been identified that allows unauthorized access to Azure Resource Manager APIs through the resource proxy of the Azure Monitor data source.
Vulnerability Detail
The vulnerability arises from the Azure Monitor data source's resource proxy, which permits users with query access to make calls to Azure Resource Manager APIs that exceed the intended scope of Grafana's functionality. This unintended proxying can lead to unauthorized access to sensitive resources, depending on the Azure role assigned to the identity used by the data source. The potential ramifications include data exposure and unauthorized actions within Azure, which could compromise the security of the entire Azure environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.1.0, < 12.4.1312.4.13 -
>= 13.0.0, < 13.0.1113.0.11 -
>= 13.1.0, < 13.1.813.1.8 -
>= 13.2.0, < 13.2.413.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict the Azure role assigned to the Azure identity used by the Grafana Azure Monitor data source to limit access to only the necessary APIs. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2026-93294 presents a significant risk to users of Grafana's Azure Monitor data source, allowing unauthorized access to Azure Resource Manager APIs. It is crucial to update to the patched versions to mitigate this vulnerability and protect your Azure resources.
See every vulnerability recorded for grafana →
FAQ
CVE-2026-93294 is a vulnerability in Grafana's Azure Monitor data source that allows unauthorized access to Azure Resource Manager APIs.
The vulnerability can lead to unauthorized access and actions on Azure resources, depending on the permissions granted to the Azure identity used by the data source.
Affected versions include Grafana 8.1.0 and later, up to 13.2.0. The vulnerability is fixed in versions 12.4.13, 13.0.11, 13.1.8, and 13.2.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider restricting the Azure role of the identity used by the Azure Monitor data source to limit access to sensitive APIs.
References
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
