Grafana Azure Monitor CVE-2026-93294

Requires an authenticated Grafana user who holds query access to a configured Azure Monitor data source, and that data source must be backed by an Azure identity (managed identity or service principal) whose role grants more than Grafana's intended ARM calls - the excess Azure role is what makes the proxy abuse impactful, and the advisory explicitly bounds impact to that role. Limiting factors that reduce real-world risk: valid Grafana authentication is required (PR:L, not unauthenticated), attack complexity is high (AC:H), and impact is zero if the data source identity is scoped to least privilege; organizations that tightly scope the Azure identity are effectively protected even without patching.

This is a moderate-severity confused-deputy flaw (CWE-441, CVSS 6.3) in Grafana's Azure Monitor data source resource proxy. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) tells a consistent story with the description: it is network-reachable but requires an already-authenticated user holding query access to an Azure Monitor data source (PR:L), high attack complexity (AC:H), and yields a scope change (S:C) because the abuse crosses into a separate security authority - Azure Resource Manager - using the data source's Azure identity. Confidentiality-only impact (C:H, I:N, A:N) matches an 'unintended proxy' that lets an attacker reach ARM APIs beyond what Grafana needs. On exploitation signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis.' The realistic risk is bounded and conditional rather than wormable - it depends on an insider or compromised low-privilege account AND on the data source's Azure role being broader than necessary, which the advisory itself states caps the impact. This is a legitimate priority for organizations running Grafana with over-privileged Azure Monitor identities, but it is not a high-urgency internet-facing emergency; absent KEV/EPSS/POC data it reads as a privilege-boundary hardening issue rather than a mass-exploitation threat.

A Grafana user who only has query access to an Azure Monitor data source sends crafted requests through the data source's resource proxy to invoke Azure Resource Manager APIs that Grafana itself never intended to expose, acting with the data source's configured Azure identity. The attacker thereby reads Azure resource information permitted by that identity's role, escalating from 'query dashboards' to 'enumerate/read Azure resources.' No public exploit code is identified at time of analysis, and high attack complexity plus the required authenticated query access limit casual abuse.