CVE-2026-93294: Grafana Enterprise 8.1.0 through 12.3.11, 12.4.0 to before 12.4.13, 13.0.0 to before 13.0.11, 13.1.0 to before 13.1.8…

Affected technology

Grafana Enterprise · 8.1.0 through 12.3.11, 12.4.0 to before 12.4.13, 13.0.0 to before 13.0.11, 13.1.0 to before 13.1.8, 13.2.0 to before 13.2.4
Grafana

Grafana OSS · 8.1.0 through 12.3.11, 12.4.0 to before 12.4.13, 13.0.0 to before 13.0.11, 13.1.0 to before 13.1.8, 13.2.0 to before 13.2.4
Grafana

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). Vendor/CNA’s CVSS 3.1 assessment (base score 6.3/10) rates confidentiality impact as high; integrity and availability impact as none.