CVE-2026-106472 · Package
NO FIX YET
Grafana's Prometheus data source forwards caller-supplied resource paths to the configured Prometheus server without limiting them to supported API endpoints. A user allowed to query the data source can read responses from other endpoints on that server using the data source's stored credentials.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted Grafana with a Prometheus data source configured with credentials. Users who can run queries against that data source can reach other endpoints on the Prometheus server. Installations without a Prometheus data source, or where the data source has no credentials, are less exposed; the sources do not say more.
Not affected if no-credentials-configured, no-prometheus-data-source
Who cares grafana, prometheus, self-hosted
grafana server -v or the About page in the Grafana UI.No fix yet, per the sources.
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.