CVE-2026-107365 · Runtime
NO FIX YET · SEE WHAT TO DO
A user with query access to a Google Cloud Monitoring data source can send requests through its resource proxy to other Cloud Monitoring API paths. The requests use the data source's own credentials, so the user can read data from any project those credentials can reach.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Grafana installations that use the Google Cloud Monitoring data source with query access granted to users. Exposure depends on the credential type: a service account or Workload Identity Federation identity with broad project access widens the impact, and a forwarded OAuth identity limits it to that user's permissions. Instances without Google Cloud Monitoring data sources, or where only trusted admins can query, are lower risk.
Not affected if admin-only-query-access, no-gcp-monitoring-datasource
Who cares gcp-monitoring, google-cloud, grafana, self-hosted
12.6.7 or later.A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.