{"id":"CVE-2026-88967","title":"Azure Monitor access token disclosure via SSRF","summary":"A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-918","CWE-20","CWE-522"],"vendor":"Grafana","product":"Grafana Enterprise","affected":["enterprise >= 10.0.0 <= 11.6.16","enterprise >= 12.0.0 <= 12.2.10","enterprise >= 12.3.0 <= 12.3.11","enterprise >= 12.4.0 <= 12.4.13","enterprise >= 13.0.0 <= 13.0.11","enterprise >= 13.1.0 <= 13.1.8","enterprise >= 13.2.0 <= 13.2.4","oss >= 10.0.0 <= 11.6.16","oss >= 12.0.0 <= 12.2.10","oss >= 12.3.0 <= 12.3.11","oss >= 12.4.0 <= 12.4.13","oss >= 13.0.0 <= 13.0.11","oss >= 13.1.0 <= 13.1.8","oss >= 13.2.0 <= 13.2.4"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:49:57.393Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88967","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-88967"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.438Z","slug":"CVE-2026-88967","body":"## Overview\n\nA user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).\n\n## Affected\n\n- `enterprise >= 10.0.0 <= 11.6.16`\n- `enterprise >= 12.0.0 <= 12.2.10`\n- `enterprise >= 12.3.0 <= 12.3.11`\n- `enterprise >= 12.4.0 <= 12.4.13`\n- `enterprise >= 13.0.0 <= 13.0.11`\n- `enterprise >= 13.1.0 <= 13.1.8`\n- `enterprise >= 13.2.0 <= 13.2.4`\n- `oss >= 10.0.0 <= 11.6.16`\n- `oss >= 12.0.0 <= 12.2.10`\n- `oss >= 12.3.0 <= 12.3.11`\n- `oss >= 12.4.0 <= 12.4.13`\n- `oss >= 13.0.0 <= 13.0.11`\n- `oss >= 13.1.0 <= 13.1.8`\n- `oss >= 13.2.0 <= 13.2.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}