{"id":"CVE-2026-114160","kind":"vulnerability","aliases":["CVE-2026-114160"],"related":[],"title":"Azure Managed Grafana: unauthenticated SSRF can disclose a service access token and elevate privileges","description":"No cwe for this issue in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.","summary":"Microsoft rates this Azure Managed Grafana flaw Critical (CVSS 9.8). Per MSRC's FAQ, an unauthenticated attacker over the network can make the service send a request to a system they control, which discloses a service access token. The attacker could then act with that token's permissions. MSRC lists it as not exploited and not publicly disclosed, with 'Exploitation Less Likely'. MSRC does not say whether Azure has already patched the managed service, and gives no affected versions or fix.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure","grafana","managed-grafana","ssrf","vendor"],"not_affected_if":[],"how_to_check":"unknown: MSRC publishes no versions or configuration for this flaw. Check whether you run Azure Managed Grafana instances (az grafana list) and watch the MSRC entry for CVE-2026-114160 for patch or customer-action details. MSRC marks customer action as required.","fix":null,"status":"open","published_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","triaged_at":"2026-11-10T19:25:43+00:00","updated_at":"2026-11-10T19:35:37+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T19:25:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Azure Managed Grafana: unauthorized network attacker can elevate privileges","impact":"high","summary":"Azure Managed Grafana, Microsoft's hosted Grafana dashboard service, has a flaw that lets an unauthorized attacker over the network gain higher privileges. The sources give a CVSS score of 9.8 but no detail on the exact mechanism.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["azure","grafana","managed-grafana"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated network attacker gains elevated privileges on the dashboard service","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-114160 for affected versions, the fix, and whether Azure has already patched the managed service.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run Azure Managed Grafana instances are the ones exposed; the sources do not say which configurations or roles are affected. Self-hosted Grafana is not named in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000678,"input_tokens":4497,"output_tokens":457,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-114160 for affected versions, the fix, and whether Azure has already patched the managed service.","search":"'-114160':17A,20A '-2026':16A,19A '9.8':37B 'access':10A,64B 'act':70B 'affect':105B 'allow':118C 'alreadi':97B 'attack':44B,67B,121C 'azur':1A,21B,31B,95B,115C 'control':59B 'could':68B 'critic':35B 'cve':15A,18A 'cvss':36B 'cwe':110C 'disclos':7A,61B,85B 'elev':13A,123C 'exploit':81B,87B 'faq':41B 'fix':108B 'flaw':34B 'give':103B 'grafana':3A,22B,25B,33B,117C 'issu':113C 'less':88B 'like':89B 'list':77B 'make':49B 'manag':2A,24B,32B,100B,116C 'managed-grafana':23B 'microsoft':28B 'msrc':39B,76B,90B 'network':47B,127C 'patch':98B 'per':38B 'permiss':75B 'privileg':14A,124C 'public':84B 'rate':29B 'request':54B 'say':93B 'send':52B 'servic':9A,51B,63B,101B 'ssrf':5A,26B 'system':57B 'token':11A,65B,73B 'unauthent':4A,43B 'unauthor':120C 'vendor':27B 'version':106B 'whether':94B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Azure Managed Grafana instances are the ones to look at. MSRC does not name affected versions, SKUs or configurations. Self-hosted Grafana and Amazon Managed Grafana are not named in the source.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azure","critical","grafana","managedgrafana","ssrf","vendor"],"campaign_type":null,"search_a":"'-114160':17A,20A '-2026':16A,19A 'access':10A 'azur':1A 'cve':15A,18A 'disclos':7A 'elev':13A 'grafana':3A 'manag':2A 'privileg':14A 'servic':9A 'ssrf':5A 'token':11A 'unauthent':4A","search_b":"'9.8':37B 'access':64B 'act':70B 'affect':105B 'alreadi':97B 'attack':44B,67B 'azur':21B,31B,95B 'control':59B 'could':68B 'critic':35B 'cvss':36B 'disclos':61B,85B 'exploit':81B,87B 'faq':41B 'fix':108B 'flaw':34B 'give':103B 'grafana':22B,25B,33B 'less':88B 'like':89B 'list':77B 'make':49B 'manag':24B,32B,100B 'managed-grafana':23B 'microsoft':28B 'msrc':39B,76B,90B 'network':47B 'patch':98B 'per':38B 'permiss':75B 'public':84B 'rate':29B 'request':54B 'say':93B 'send':52B 'servic':51B,63B,101B 'ssrf':26B 'system':57B 'token':65B,73B 'unauthent':43B 'vendor':27B 'version':106B 'whether':94B","search_c":"'allow':118C 'attack':121C 'azur':115C 'cwe':110C 'elev':123C 'grafana':117C 'issu':113C 'manag':116C 'network':127C 'privileg':124C 'unauthor':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114160","severity":null,"published_at":"2026-11-10T19:19:09+00:00","modified_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","fetched_at":"2026-11-10T19:24:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114160:2525","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160","severity":null,"published_at":"2026-11-10T19:35:37+00:00","modified_at":"2026-11-10T19:35:37+00:00","first_seen_at":"2026-11-10T19:35:37+00:00","fetched_at":"2026-11-10T19:35:37+00:00","note":"MSRC Security Update Guide data (api.msrc.microsoft.com): SSRF (CWE-918), unauthenticated, no user interaction, discloses a service access token; CVSS 9.8 (temporal 8.5), Exploitation Less Likely, not exploited, not publicly disclosed. customerActionRequired=true but MSRC gives no affected versions, fix, or statement on whether Azure already patched. Nothing verified; fix unknown. No community posts searched (brand-new, 15 min old); revisit when MSRC adds detail.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160"]}],"documents":[{"id":117593,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160","title":"MSRC: CVE-2026-114160 Azure Managed Grafana Elevation of Privilege Vulnerability (Security Update Guide data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}