CVE-2026-106472: Server-side request forgery in the Prometheus data source resource API
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has permission to query the affected Prometheus data source can exploit it. The user must also be able to supply a resource path to the data source resource API.
What access can an attacker gain?
The attacker can read responses from other endpoints on the configured Prometheus server. Those requests use the data source's credentials, so accessible information depends on what those credentials can access.
Is exploitation straightforward over the network?
The issue is network-reachable, but exploitation has high attack complexity and requires low-privileged access to query the data source. No user interaction is required.