{"id":"CVE-2026-93294","title":"A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy)","summary":"A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Az…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-441","CWE-863","CWE-1220","CWE-918"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["multicluster_global_hub","advanced_cluster_management_for_kubernetes 2","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","hardened_images"],"patched":["hardened_images"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:02:37.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93294","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-93294","label":"security@grafana.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93294.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93294"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550715"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93294"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93294"},{"url":"https://access.redhat.com/errata/RHSA-2026:85295"},{"url":"https://access.redhat.com/errata/RHSA-2026:85544"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00267,"epssPercentile":0.18727,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T17:26:28.085923Z"},"scores":{"nvd":6.3,"vendor":4.3,"cna":6.3},"ingestedAt":"2026-10-13T18:41:42.744Z","slug":"CVE-2026-93294","body":"## Overview\n\nA user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93294.json)\n- **RHSA-2026:85295** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85295)\n- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}