---
id: CVE-2026-88967
title: Azure Monitor access token disclosure via SSRF
summary: >-
  A user with query access to an Azure Monitor data source in Grafana can cause
  server-side requests to an attacker-controlled endpoint that disclose the data
  source's Azure access token (server-side request forgery).
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
  - CWE-20
  - CWE-522
vendor: Grafana
product: Grafana Enterprise
affected:
  - enterprise >= 10.0.0 <= 11.6.16
  - enterprise >= 12.0.0 <= 12.2.10
  - enterprise >= 12.3.0 <= 12.3.11
  - enterprise >= 12.4.0 <= 12.4.13
  - enterprise >= 13.0.0 <= 13.0.11
  - enterprise >= 13.1.0 <= 13.1.8
  - enterprise >= 13.2.0 <= 13.2.4
  - oss >= 10.0.0 <= 11.6.16
  - oss >= 12.0.0 <= 12.2.10
  - oss >= 12.3.0 <= 12.3.11
  - oss >= 12.4.0 <= 12.4.13
  - oss >= 13.0.0 <= 13.0.11
  - oss >= 13.1.0 <= 13.1.8
  - oss >= 13.2.0 <= 13.2.4
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:49:57.393Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88967'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-88967'
tags:
  - cve.org
ingestedAt: '2026-10-28T17:14:44.438Z'
---

## Overview

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

## Affected

- `enterprise >= 10.0.0 <= 11.6.16`
- `enterprise >= 12.0.0 <= 12.2.10`
- `enterprise >= 12.3.0 <= 12.3.11`
- `enterprise >= 12.4.0 <= 12.4.13`
- `enterprise >= 13.0.0 <= 13.0.11`
- `enterprise >= 13.1.0 <= 13.1.8`
- `enterprise >= 13.2.0 <= 13.2.4`
- `oss >= 10.0.0 <= 11.6.16`
- `oss >= 12.0.0 <= 12.2.10`
- `oss >= 12.3.0 <= 12.3.11`
- `oss >= 12.4.0 <= 12.4.13`
- `oss >= 13.0.0 <= 13.0.11`
- `oss >= 13.1.0 <= 13.1.8`
- `oss >= 13.2.0 <= 13.2.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.