{"id":"CVE-2026-88967","kind":"vulnerability","aliases":["CVE-2026-88967"],"related":[],"title":"Grafana: Azure Monitor data source leaks access token via server-side requests","description":"A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).","summary":"A Grafana user with query access to an Azure Monitor data source can make the server send requests to an attacker-controlled endpoint. The request discloses the data source's Azure access token.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grafana","fixed":["13.3.0","13.2.5","13.1.9","13.0.12","12.4.14"],"affected":"unknown lower bound, below the fixed versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["azure-monitor","grafana","package","self-hosted","ssrf"],"not_affected_if":["auth-required","no-azure-monitor-datasource"],"how_to_check":"Check your Grafana version (Help menu, or GET /api/health). Exposed if it is older than the fixed release for your line and you have an Azure Monitor data source that other users can query. Lower bound of affected versions: unknown until Grafana publishes the advisory.","fix":"Upgrade Grafana to 13.3.0, 13.2.5, 13.1.9, 13.0.12 or 12.4.14, whichever matches your release line (per Grafana changelog). Until then, limit query access to Azure Monitor data sources.","status":"open","published_at":"2026-10-28T17:18:46+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:20+00:00","updated_at":"2026-10-28T17:38:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:36:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Grafana: Azure Monitor data source leaks access token via server-side requests","impact":"high","summary":"A Grafana user with query access to an Azure Monitor data source can make the server send requests to an attacker-controlled endpoint. The request discloses the data source's Azure access token.","category":"package","nicknames":[],"who_cares":["grafana","azure-monitor","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Azure access token for the data source is disclosed to an attacker","analyst_note":"Check the NVD entry and Grafana security advisory for affected and fixed Grafana versions and the Azure Monitor plugin details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000494,"input_tokens":3275,"output_tokens":332,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Grafana security advisory for affected and fixed Grafana versions and the Azure Monitor plugin details.","search":"'-2026':15A,18A '-88967':16A,19A 'access':7A,35B,62B,68C,96C 'attack':51B,86C 'attacker-control':50B,85C 'azur':2A,22B,38B,61B,71C,95C 'azure-monitor':21B 'caus':78C 'control':52B,87C 'cve':14A,17A 'data':4A,40B,58B,73C,92C 'disclos':56B,90C 'endpoint':53B,88C 'forgeri':102C 'grafana':1A,20A,24B,31B,76C 'host':28B 'leak':6A 'make':43B 'monitor':3A,23B,39B,72C 'packag':25B 'queri':34B,67C 'request':13A,47B,55B,82C,101C 'self':27B 'self-host':26B 'send':46B 'server':11A,45B,80C,99C 'server-sid':10A,79C,98C 'side':12A,81C,100C 'sourc':5A,41B,59B,74C,93C 'ssrf':29B 'token':8A,63B,97C 'user':32B,65C 'via':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88967","severity":null,"published_at":"2026-10-28T17:18:46+00:00","modified_at":"2026-10-28T17:18:46+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88967:969","url":null,"severity":null,"published_at":"2026-10-28T17:38:26+00:00","modified_at":"2026-10-28T17:38:26+00:00","first_seen_at":"2026-10-28T17:38:26+00:00","fetched_at":"2026-10-28T17:38:26+00:00","note":"Grafana's changelog lists CVE-2026-88967 as fixed in 13.3.0, 13.2.5, 13.1.9, 13.0.12 and 12.4.14 (all released 2026-10-27). The per-CVE Grafana advisory is not on the advisories index yet and the NVD page has no content, so the affected lower bound is unknown. Nothing was marked verified. No exploitation or PoC found."}],"documents":[{"id":11642,"url":"https://raw.githubusercontent.com/grafana/grafana/main/CHANGELOG.md","title":"Grafana CHANGELOG (13.3.0, 13.2.5 list CVE-2026-88967)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":11643,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88967","title":"NVD CVE-2026-88967","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}