CVE-2026-93294

Katalog CVE

CVSS 6.3 · Medium

Kerentanan Unintended Proxy or Intermediary ('Confused Deputy'). Skor CVSS 3.1 6.3 (Medium) menurut grafana.com.

Deskripsi (NVD)

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Received

CVSS 3.1

6.3 (Medium), sumber grafana.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-863: Incorrect Authorization
CWE-1220: Insufficient Granularity of Access Control

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://grafana.com/security/security-advisories/cve-2026-93294