Database/Control plane, storage & DevOps

Grafana: SSRF in the Azure Monitor data source leaks the data source's Azure access token

CVSS 7.7CVE-2026-88967Control plane, storage & DevOpscurated

Impact

Any Grafana user who can run queries against an Azure Monitor data source can steer the server-side request to an endpoint they control and capture the Azure access token Grafana attaches to it. That token carries the data source's own permissions, not the user's, so a low-privileged viewer in the fleet's observability stack walks away with cloud credentials for whatever subscription the monitoring integration was granted. For a GPU operator this matters because the Grafana instance watching DCGM, fabric and node health is typically the one system every team has an account on, and its data source identities are often over-scoped at setup time.

Who can reach it

Authenticated Grafana user with query access to an Azure Monitor data source, over the network. No admin rights needed.

What to do

Upgrade Grafana to the patched release named in Grafana's advisory for this CVE and restart the Grafana service - a daemon restart, no node impact. Because the token may already have been exfiltrated, rotate the credentials behind any Azure Monitor data source after patching and review Azure sign-in and activity logs for use from unexpected addresses. As an interim step, remove query permission on Azure Monitor data sources from users who do not need it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-88967 https://grafana.com/security/security-advisories/cve-2026-88967

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.