Azure Managed Grafana: unauthenticated SSRF can disclose a service access token and elevate privileges

Microsoft rates this Azure Managed Grafana flaw Critical (CVSS 9.8). Per MSRC's FAQ, an unauthenticated attacker over the network can make the service send a request to a system they control, which discloses a service access token. The attacker could then act with that token's permissions. MSRC lists it as not exploited and not publicly disclosed, with 'Exploitation Less Likely'. MSRC does not say whether Azure has already patched the managed service, and gives no affected versions or fix.