---
id: CVE-2026-93294
title: >-
  A user with query access to an Azure Monitor data source can use its resource
  proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the
  data source's Azure identity (unintended proxy)
summary: >-
  A user with query access to an Azure Monitor data source can use its resource
  proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the
  data source's Azure identity (unintended proxy). The impact is bounded by the
  Az…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-441
  - CWE-863
  - CWE-1220
  - CWE-918
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:19:10.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93294'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-93294'
    label: security@grafana.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93294.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93294'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550715'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93294'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93294'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
ingestedAt: '2026-10-13T18:41:42.744Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - multicluster_global_hub
  - advanced_cluster_management_for_kubernetes 2
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
scores:
  nvd: 6.3
  vendor: 4.3
  cna: 6.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T17:26:28.085923Z'
---

## Overview

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93294.json)