{"id":"CVE-2026-107365","kind":"vulnerability","aliases":["CVE-2026-107365"],"related":[],"title":"Grafana Google Cloud Monitoring plugin: data source proxy reads other projects","description":"A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.","summary":"A user with query access to a Google Cloud Monitoring data source can send requests through its resource proxy to other Cloud Monitoring API paths. The requests use the data source's own credentials, so the user can read data from any project those credentials can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gcp-monitoring","google-cloud","grafana","runtime","self-hosted"],"not_affected_if":["admin-only-query-access","no-gcp-monitoring-datasource"],"how_to_check":"- Check the installed version of the Google Cloud Monitoring plugin in Grafana (Administration > Plugins).\n- List Google Cloud Monitoring data sources and note which credentials each uses (service account, forwarded OAuth identity, or Workload Identity Federation).\n- Review the IAM roles granted to those credentials across Google Cloud projects.","fix":"- Google Cloud Monitoring plugin: move to `12.6.7` or later.","status":"open","published_at":"2026-11-12T18:17:12+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","triaged_at":"2026-11-12T18:43:02+00:00","updated_at":"2026-11-12T18:43:02+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T18:43:02Z","model":"claude-haiku-5-5","output":{"fix":"- Google Cloud Monitoring plugin: move to `12.6.7` or later.","reach":"network","title":"Grafana Google Cloud Monitoring plugin: data source proxy reads other projects","impact":"medium","summary":"A user with query access to a Google Cloud Monitoring data source can send requests through its resource proxy to other Cloud Monitoring API paths. The requests use the data source's own credentials, so the user can read data from any project those credentials can reach.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["grafana","google-cloud","gcp-monitoring","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"user reads monitoring data from any project the credentials reach","analyst_note":"Sources list only NVD; no vendor advisory was checked for the exact affected version range.\n","how_to_check":"- Check the installed version of the Google Cloud Monitoring plugin in Grafana (Administration > Plugins).\n- List Google Cloud Monitoring data sources and note which credentials each uses (service account, forwarded OAuth identity, or Workload Identity Federation).\n- Review the IAM roles granted to those credentials across Google Cloud projects.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-gcp-monitoring-datasource","admin-only-query-access"],"who_is_affected":"Grafana installations that use the Google Cloud Monitoring data source with query access granted to users. Exposure depends on the credential type: a service account or Workload Identity Federation identity with broad project access widens the impact, and a forwarded OAuth identity limits it to that user's permissions. Instances without Google Cloud Monitoring data sources, or where only trusted admins can query, are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000789,"input_tokens":4588,"output_tokens":660,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107365':14A,17A '-2026':13A,16A '12.6.7':147C 'access':33B,80C 'api':52B,100C 'cloud':3A,23B,37B,50B,84C,98C,144C 'credenti':62B,73B,107C,115C,138C 'cve':12A,15A 'data':6A,39B,58B,68B,86C,104C,110C,120C 'depend':135C 'feder':132C 'fix':141C 'forward':122C 'gcp':19B 'gcp-monitor':18B 'googl':2A,22B,36B,83C,143C 'google-cloud':21B 'grafana':1A,24B 'host':28B 'ident':127C,131C 'impact':134C 'monitor':4A,20B,38B,51B,85C,99C,145C 'oauth':126C 'path':53B,101C 'permiss':140C 'plugin':5A,146C 'project':11A,71B,113C 'proxi':8A,47B,92C 'queri':32B,79C 'reach':75B,117C 'read':9A,67B,109C 'request':43B,55B,95C 'resourc':46B,91C 'runtim':25B 'self':27B 'self-host':26B 'send':42B,94C 'sourc':7A,40B,59B,87C,105C,121C 'use':56B,89C,129C 'user':30B,65B,77C,124C 'workload':130C","nicknames":[],"mitigations":[],"who_affected":"Grafana installations that use the Google Cloud Monitoring data source with query access granted to users. Exposure depends on the credential type: a service account or Workload Identity Federation identity with broad project access widens the impact, and a forwarded OAuth identity limits it to that user's permissions. Instances without Google Cloud Monitoring data sources, or where only trusted admins can query, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gcpmonitoring","googlecloud","grafana","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-107365':14A,17A '-2026':13A,16A 'cloud':3A 'cve':12A,15A 'data':6A 'googl':2A 'grafana':1A 'monitor':4A 'plugin':5A 'project':11A 'proxi':8A 'read':9A 'sourc':7A","search_b":"'access':33B 'api':52B 'cloud':23B,37B,50B 'credenti':62B,73B 'data':39B,58B,68B 'gcp':19B 'gcp-monitor':18B 'googl':22B,36B 'google-cloud':21B 'grafana':24B 'host':28B 'monitor':20B,38B,51B 'path':53B 'project':71B 'proxi':47B 'queri':32B 'reach':75B 'read':67B 'request':43B,55B 'resourc':46B 'runtim':25B 'self':27B 'self-host':26B 'send':42B 'sourc':40B,59B 'use':56B 'user':30B,65B","search_c":"'12.6.7':147C 'access':80C 'api':100C 'cloud':84C,98C,144C 'credenti':107C,115C,138C 'data':86C,104C,110C,120C 'depend':135C 'feder':132C 'fix':141C 'forward':122C 'googl':83C,143C 'ident':127C,131C 'impact':134C 'monitor':85C,99C,145C 'oauth':126C 'path':101C 'permiss':140C 'plugin':146C 'project':113C 'proxi':92C 'queri':79C 'reach':117C 'read':109C 'request':95C 'resourc':91C 'send':94C 'sourc':87C,105C,121C 'use':89C,129C 'user':77C,124C 'workload':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107365","severity":null,"published_at":"2026-11-12T18:17:12+00:00","modified_at":"2026-11-12T18:17:12+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","fetched_at":"2026-11-12T18:40:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}