---
id: "CVE-2026-107365"
page: "https://infrastack.ai/live/CVE-2026-107365"
kind: "vulnerability"
aliases: ["CVE-2026-107365"]
title: "Grafana Google Cloud Monitoring plugin: data source proxy reads other projects"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["gcp-monitoring", "google-cloud", "grafana", "runtime", "self-hosted"]
not_affected_if: ["admin-only-query-access", "no-gcp-monitoring-datasource"]
published_at: "2026-11-12T18:17:12+00:00"
first_seen_at: "2026-11-12T18:40:37+00:00"
updated_at: "2026-11-12T18:43:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107365", "first_seen_at": "2026-11-12T18:40:37+00:00"}]
exploit_sources: []
---

# Grafana Google Cloud Monitoring plugin: data source proxy reads other projects

Link for people: https://infrastack.ai/live/CVE-2026-107365 (this .md is for agents)

A user with query access to a Google Cloud Monitoring data source can send requests through its resource proxy to other Cloud Monitoring API paths. The requests use the data source's own credentials, so the user can read data from any project those credentials can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Google Cloud Monitoring plugin in Grafana (Administration > Plugins).
- List Google Cloud Monitoring data sources and note which credentials each uses (service account, forwarded OAuth identity, or Workload Identity Federation).
- Review the IAM roles granted to those credentials across Google Cloud projects.

## Fix

- Google Cloud Monitoring plugin: move to `12.6.7` or later.

## Timeline

- 2026-11-12T18:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107365

## From the sources

A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_