CVE-2026-88967: Azure Monitor access token disclosure via SSRF
Published Oct 28, 2026
·Updated
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Affected Software
1 affected component
Grafana Labs Grafana
Event History
Oct 28, 2026
CVE Published
via MITRE·04:49 PM
Data Sourced
via MITRE·04:49 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs query access to an Azure Monitor data source in Grafana. Exploitation does not require user interaction and can be performed over the network.
2
What is exposed if exploitation succeeds?
The attacker can cause Grafana to send server-side requests to an attacker-controlled endpoint and disclose the Azure access token configured for the affected data source.
3
Are Grafana instances without an Azure Monitor data source affected?
The described attack requires an Azure Monitor data source and query access to it. The provided information does not establish exposure for instances that do not use such a data source.