---
id: "CVE-2026-88967"
kind: "vulnerability"
aliases: ["CVE-2026-88967"]
title: "Grafana: Azure Monitor data source leaks access token via server-side requests"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "grafana", "fixed": ["13.3.0", "13.2.5", "13.1.9", "13.0.12", "12.4.14"], "affected": "unknown lower bound, below the fixed versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["azure-monitor", "grafana", "package", "self-hosted", "ssrf"]
not_affected_if: ["auth-required", "no-azure-monitor-datasource"]
published_at: "2026-10-28T17:18:46+00:00"
first_seen_at: "2026-10-28T17:34:10+00:00"
updated_at: "2026-10-28T17:38:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88967", "first_seen_at": "2026-10-28T17:34:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:38:26+00:00"}]
---

# Grafana: Azure Monitor data source leaks access token via server-side requests

A Grafana user with query access to an Azure Monitor data source can make the server send requests to an attacker-controlled endpoint. The request discloses the data source's Azure access token.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:grafana affected unknown lower bound, below the fixed versions fixed 13.3.0, 13.2.5, 13.1.9, 13.0.12, 12.4.14

## How to check

Check your Grafana version (Help menu, or GET /api/health). Exposed if it is older than the fixed release for your line and you have an Azure Monitor data source that other users can query. Lower bound of affected versions: unknown until Grafana publishes the advisory.

## Fix

Upgrade Grafana to 13.3.0, 13.2.5, 13.1.9, 13.0.12 or 12.4.14, whichever matches your release line (per Grafana changelog). Until then, limit query access to Azure Monitor data sources.

## Timeline

- 2026-10-28T17:34:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88967
- 2026-10-28T17:38:26+00:00 analyst — Grafana's changelog lists CVE-2026-88967 as fixed in 13.3.0, 13.2.5, 13.1.9, 13.0.12 and 12.4.14 (all released 2026-10-27). The per-CVE Grafana advisory is not on the advisories index yet and the NVD page has no content, so the affected lower bound is unknown. Nothing was marked verified. No exploitation or PoC found.

## Documents

- [fix] Grafana CHANGELOG (13.3.0, 13.2.5 list CVE-2026-88967) https://raw.githubusercontent.com/grafana/grafana/main/CHANGELOG.md
- [mentions] NVD CVE-2026-88967 https://nvd.nist.gov/vuln/detail/CVE-2026-88967

## From the sources

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_