UBUNTU-CVE-2026-88967: High severity ubuntu/grafana vulnerability
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs query access to an Azure Monitor data source in Grafana. The issue is therefore relevant where users with that level of access are untrusted or could be compromised.
What access or configuration is required for impact?
Grafana must have an Azure Monitor data source configured, and the attacker must be able to query it. Successful exploitation can cause Grafana to send a server-side request to an attacker-controlled endpoint and disclose that data source's Azure access token.
What can be done while a fix is not available?
Limit query access to Azure Monitor data sources to trusted users and review access granted to existing users. Restricting access reduces the ability to trigger the server-side request that exposes the token.