Skip to content
Sign in
7.7 High

CVE-2026-88967 Azure Monitor access token disclosure via SSRF

Description

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Affected products and versions

Product Affected versions Fixed in
Grafana Enterprise 13.2 13.2.0 → 13.2.4 No fix stated
Grafana Enterprise 13.1 13.1.0 → 13.1.8 No fix stated
Grafana Enterprise 13.0 13.0.0 → 13.0.11 No fix stated
Grafana Enterprise 12.4 12.4.0 → 12.4.13 No fix stated
Grafana Enterprise 12.3 12.3.0 → 12.3.11 No fix stated
Grafana Enterprise 12.0 12.0.0 → 12.2.10 No fix stated
Grafana Enterprise 10.0 10.0.0 → 11.6.16 No fix stated
Grafana OSS 13.2 13.2.0 → 13.2.4 No fix stated
Grafana OSS 13.1 13.1.0 → 13.1.8 No fix stated
Show the 5 other branches
Product Affected versions Fixed in
Grafana OSS 13.0 13.0.0 → 13.0.11 No fix stated
Grafana OSS 12.4 12.4.0 → 12.4.13 No fix stated
Grafana OSS 12.3 12.3.0 → 12.3.11 No fix stated
Grafana OSS 12.0 12.0.0 → 12.2.10 No fix stated
Grafana OSS 10.0 10.0.0 → 11.6.16 No fix stated

Other CVEs of Grafana Enterprise

The 41 CVEs of Grafana Enterprise →
CVE-2026-33379 Dashboard snapshot permission bypass 8.5 High CVE-2026-79656 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 6.0 Medium CVE-2026-103506 SSO settings authorization bypass 8.9 High CVE-2026-88858 Server-side expression parser denial of service 6.5 Medium
Track this CVE