What is GHSA-5wf9-m99g-f6xj?

GHSA-5wf9-m99g-f6xj is a security advisory published by GitHub Security Advisories with Medium severity. A user with query access to an Azure Monitor data source can use its resource proxy to call Azure...

Which CVE IDs does GHSA-5wf9-m99g-f6xj cover?

GHSA-5wf9-m99g-f6xj covers the following CVE IDs: CVE-2026-93294. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5wf9-m99g-f6xj?

GHSA-5wf9-m99g-f6xj has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

GHSA-5wf9-m99g-f6xjMediumCVSS 6.3

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure...

Vendor

GitHub Security Advisories

Published

October 13, 2026

Last Modified

October 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-93294 →

📋 Description

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-93294
https://grafana.com/security/security-advisories/cve-2026-93294
https://github.com/advisories/GHSA-5wf9-m99g-f6xj