7.7
HighCVSS 3.1 · from GRAFANA
CVE-2026-88967
Azure Monitor access token disclosure via SSRF
Grafana Enterprise · Server-side request forgery · CWE-918AffectedGrafana Enterprise, Grafana OSS
FixNo fix listed yet.
PublishedOct 28, 16:49 · GRAFANA
ScoredOct 28 · 7.7 · GRAFANA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data. CVSS impact.
Description
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
From GRAFANA
Affected and fixed versions
ProductAffectedFixed inGrafana Enterprise10.0.0 – 11.6.16–Grafana Enterprise12.0.0 – 12.2.10–Grafana Enterprise12.3.0 – 12.3.11–Grafana Enterprise12.4.0 – 12.4.13–Grafana Enterprise13.0.0 – 13.0.11–Grafana Enterprise13.1.0 – 13.1.8–Grafana Enterprise13.2.0 – 13.2.4–Grafana OSS10.0.0 – 11.6.16–Grafana OSS12.0.0 – 12.2.10–Grafana OSS12.3.0 – 12.3.11–Grafana OSS12.4.0 – 12.4.13–Grafana OSS13.0.0 – 13.0.11–Grafana OSS13.1.0 – 13.1.8–Grafana OSS13.2.0 – 13.2.4–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known