A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs,… (CVE-2026-93294)

This vulnerability allows a user who has query access to an Azure Monitor data source in Grafana to leverage the data source's resource proxy to make calls to Azure Resource Manager APIs that exceed the intended permissions required by Grafana. The unauthorized access occurs through the data source's Azure identity, effectively acting as an unintended proxy. The extent of the impact is constrained by the permissions granted to the Azure identity via its assigned Azure role. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

An attacker with query access to the Azure Monitor data source could perform unauthorized Azure Resource Manager API calls using the data source's identity. The potential impact depends on the privileges of the Azure identity associated with the data source. Confidentiality could be compromised if the identity has read access to sensitive resources, but integrity and availability impacts are not indicated. The vulnerability does not allow privilege escalation beyond the assigned Azure role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the Azure roles assigned to the data source's identity to the minimum necessary permissions to limit potential impact. Monitor and audit Azure Resource Manager API calls made via the data source's identity to detect any unauthorized activity.