CVE-2026-93294

A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source's configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity's permissions.

A moderate information disclosure flaw was found in Grafana, affecting the grafana component as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat Ceph Storage, Red Hat Advanced Cluster Management for Kubernetes, Multicluster Global Hub, and Red Hat In-Vehicle OS, as well as Red Hat Hardened Images and Fedora community builds. An authenticated Grafana user with query access to an Azure Monitor data source can misuse its resource proxy to send requests to Azure Resource Manager APIs beyond those Grafana requires, using the data source's configured cloud identity. This unintended proxying allows an attacker to read sensitive Azure cloud resources within the scope of that identity's permissions, with no impact on integrity or availability. Some RHEL 8 grafana streams are not affected because the vulnerable code is not present. Red Hat rates this flaw 4.3 (Moderate) rather than the upstream 6.3 because the disclosure is bounded by the Azure role granted to the data source identity, resulting in low confidentiality impact with unchanged scope rather than the high confidentiality impact across a changed scope assessed upstream. For the affected Red Hat products the fix is deferred to a future update given the moderate impact and the authentication and query-access prerequisites; the residual risk is that an authenticated user could retrieve Azure resources accessible to the data source identity. For Red Hat Hardened Images and Fedora, a fix is being pursued through those channels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.