[ CVE-2026-93294 · Published 13 Oct 2026 ]

Vulnerability in Grafana Enterprise

CVSS 6.3 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund13 Oct 2026WID-SEC-2026-3910

Grafana: Multiple vulnerabilities Translated from German
CVE-2026-33374CVE-2026-95502CVE-2026-93294+1 more CVEs

[ References ]References

grafana.com/security/security-advisories/cve-2026-93294

[ Facts ]Key facts

CVE: CVE-2026-93294
EUVD: EUVD-2026-98903
Published: 13 Oct 2026, 18:17 UTC
Updated: 16 Oct 2026, 20:02 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Scored by security@grafana.com
EPSS: 0.27% chance of exploitation in 30 days · higher than 18% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-441 CWE-863 CWE-1220

[ Affected ]Affected products

Grafana Grafana Enterprise8.1.0 – ≤ 12.3.11, 12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4
Grafana Grafana OSS8.1.0 – ≤ 12.3.11, 12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Grafana: Multiple vulnerabilities Translated from German

[ References ]References