CVE-2026-93294: Azure Monitor Grafana Proxy Vulnerability

CVE-2026-93294 Overview

CVE-2026-93294 affects Grafana's Azure Monitor data source. A user with query access can abuse the data source's resource proxy to call Azure Resource Manager (ARM) APIs beyond those Grafana requires. The proxy forwards these calls using the data source's configured Azure identity, enabling unintended access scoped to that identity's Azure role.

The issue is classified under [CWE-441] (Unintended Proxy or Intermediary, also known as Confused Deputy). The impact depends entirely on the Azure permissions granted to the data source identity. Broad roles such as Reader or Contributor at subscription scope significantly expand the blast radius.

Critical Impact
Authenticated Grafana users with query access to an Azure Monitor data source can issue arbitrary ARM API calls under the data source's Azure identity, bounded only by that identity's Azure role assignments.

Affected Products

Grafana instances configured with an Azure Monitor data source
Grafana deployments granting query access to Azure Monitor to non-administrative users
Grafana environments where the Azure Monitor data source identity holds broad ARM role assignments

Discovery Timeline

2026-10-13 - CVE CVE-2026-93294 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-93294

Vulnerability Analysis

Grafana's Azure Monitor data source uses a server-side resource proxy to forward queries to Azure APIs. The proxy authenticates outbound requests using the Azure identity configured on the data source, such as a managed identity or service principal. Grafana only requires a narrow set of ARM endpoints to render dashboards and alerts.

The proxy does not sufficiently restrict which ARM API paths it will relay. A Grafana user with query permission on the data source can craft requests through the proxy to reach ARM endpoints outside the intended allowlist. The outbound call carries the data source's Azure credentials, so Azure authorizes it based on that identity rather than the Grafana user.

This is a classic confused deputy pattern. The Grafana user cannot authenticate to Azure directly, but the proxy performs privileged actions on their behalf. If the data source identity holds Reader access across a subscription, the Grafana user can enumerate every resource in that subscription through the proxy.

Root Cause

The root cause is insufficient path or scope validation inside the Azure Monitor data source proxy. Grafana trusts proxied requests to stay within the APIs needed for monitoring queries, but the proxy accepts broader ARM request paths and forwards them with full data source credentials.

Attack Vector

An authenticated Grafana user issues an HTTP request to the Azure Monitor data source's resource proxy endpoint. The user supplies an ARM API path that Grafana does not normally invoke, such as resource listings, role assignment reads, or configuration endpoints exposed by Reader-equivalent roles. Grafana forwards the request to ARM using the data source's Azure identity, and the response is returned to the user. The ceiling of what can be read, modified, or invoked is set by the Azure role bound to that identity.

No exploitation code is published. Refer to the Grafana Security Advisory CVE-2026-93294 for vendor-provided technical details.

Detection Methods for CVE-2026-93294

Indicators of Compromise

ARM activity log entries showing API calls from the Azure Monitor data source identity to endpoints outside the Grafana query path (for example, Microsoft.Authorization/roleAssignments/read or broad Microsoft.Resources/subscriptions/resources enumerations).
Grafana HTTP access logs showing requests to the Azure Monitor data source proxy path with URIs that do not match standard metrics or logs query endpoints.
Spikes in ARM read volume attributable to the data source service principal or managed identity.

Detection Strategies

Correlate Grafana proxy request logs with Azure Activity Log entries using the data source identity's object ID to attribute ARM calls back to Grafana user sessions.
Alert on ARM API paths invoked by the data source identity that fall outside an allowlist of endpoints Grafana legitimately uses for Azure Monitor queries.
Review Grafana audit logs for non-administrator users querying the Azure Monitor data source with unusual proxy request patterns.

Monitoring Recommendations

Ingest Azure Activity Logs and Grafana server logs into a central analytics platform and pivot on the data source identity.
Baseline normal ARM endpoint usage per data source identity and alert on deviations.
Monitor role assignments on identities used by Grafana data sources; flag any role expansion beyond the minimum needed for Azure Monitor queries.

How to Mitigate CVE-2026-93294

Immediate Actions Required

Upgrade Grafana to the fixed version listed in the Grafana Security Advisory CVE-2026-93294.
Audit every Azure Monitor data source and the Azure role assignments granted to its identity; remove any permissions beyond what Azure Monitor queries require.
Restrict Grafana query access on Azure Monitor data sources to trusted users and teams only.

Patch Information

Grafana Labs has issued a security advisory with fixed versions. Consult the Grafana Security Advisory CVE-2026-93294 for the specific patched releases and upgrade guidance applicable to your deployment channel.

Workarounds

Scope the Azure identity used by the data source to the narrowest possible role (for example, Monitoring Reader at a specific resource group) rather than subscription-wide Reader or Contributor.
Remove or disable Azure Monitor data sources that are not actively used.
Limit data source query permissions in Grafana using role-based access control so only required users can issue proxied requests.

bash

# Example: assign least-privilege Monitoring Reader at a resource group scope
# instead of broader subscription-level roles
az role assignment create \
  --assignee <data-source-identity-object-id> \
  --role "Monitoring Reader" \
  --scope /subscriptions/<sub-id>/resourceGroups/<rg-name>