---
id: CVE-2026-93294
title: >-
  A user with query access to an Azure Monitor data source can use its resource
  proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the
  data source's Azure identity (unintended proxy)
summary: >-
  A user with query access to an Azure Monitor data source can use its resource
  proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the
  data source's Azure identity (unintended proxy). The impact is bounded by the
  Az…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-441
  - CWE-863
  - CWE-1220
  - CWE-918
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - multicluster_global_hub
  - advanced_cluster_management_for_kubernetes 2
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
patched:
  - hardened_images
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:02:37.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93294'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-93294'
    label: security@grafana.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93294.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93294'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550715'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93294'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93294'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85295'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85544'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00267
epssPercentile: 0.18727
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T17:26:28.085923Z'
scores:
  nvd: 6.3
  vendor: 4.3
  cna: 6.3
ingestedAt: '2026-10-13T18:41:42.744Z'
---

## Overview

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93294.json)
- **RHSA-2026:85295** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85295)
- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)