What is CVE-2026-93294?

CVE-2026-93294 is a security advisory published by Grafana Labs Security. Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Why does CVE-2026-93294 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-93294?

CVE-2026-93294 affects 1 product, including: Grafana.

CVE-2026-93294Disclosed before NVD

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Vendor

Grafana Labs Security

Published

October 13, 2026

Last Modified

—

📋 Description

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source’s Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

🎯 Affected products1

Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-93294/