Live › vulnerability › CVE-2026-88967
Go to dashboardA Grafana user with query access to an Azure Monitor data source can make the server send requests to an attacker-controlled endpoint. The request discloses the data source's Azure access token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| grafana | vendor | unknown lower bound, below the fixed versions | 13.3.0, 13.2.5, 13.1.9, 13.0.12, 12.4.14 |
13.3.0, 13.2.5, 13.1.9, 13.0.12 or 12.4.14, whichever matches your release line (per Grafana changelog)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
This page as .md · .json · in your agent: get_signal("CVE-2026-88967")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.