CVE-2026-93294: Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to meaningful impact?
Deployments using an Azure Monitor data source are exposed when users have query access to that data source and its Azure identity has Azure Resource Manager permissions. The possible impact is limited by the Azure role assigned to that identity.
What access does an attacker need to attempt exploitation?
An attacker needs query access to the Azure Monitor data source. Exploitation does not require user interaction, but the attack complexity is rated high.
Whose Azure permissions are used for the unauthorized API calls?
The calls are made with the Azure identity configured for the data source, rather than being constrained to only the Azure Resource Manager APIs Grafana requires. Review that identity's assigned Azure role to determine the accessible resources and actions.