Grafana EUVD-2026-112193

Exploitation requires (1) an Azure Monitor data source configured in the Grafana instance and (2) an authenticated account that holds query access to that data source (PR:L) - it is not reachable by fully anonymous users. Given those prerequisites, no user interaction, special timing, or unusual complexity is needed (AC:L/UI:N) and the request is network-reachable. The practical limiting factors are therefore the presence of an Azure Monitor data source and possession of a query-capable role; environments without Azure Monitor data sources are not exposed, and the trigger mechanism beyond 'a user with query access can cause server-side requests to an attacker-controlled endpoint' is not further detailed in the available sources.

This is a genuine but conditional priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7 High) shows a network-reachable, low-complexity attack that requires low privileges (PR:L) - specifically a Grafana account with query access to an Azure Monitor data source - and no user interaction. The scope change (S:C) and C:H are well justified: the leaked Azure access token is credential material that unlocks Azure resources beyond Grafana itself, so the real impact extends past the vulnerable host. The vuln.today Decision label is 'this_week', consistent with a serious but not drop-everything issue. No EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept or exploit reference is present in the input - so exploitation signals are absent rather than alarming. The main risk amplifier is that query access is a relatively common, low-privilege role in multi-tenant/multi-team Grafana deployments, meaning the PR:L barrier may be low in practice; the main limiter is that an Azure Monitor data source must actually be configured and the attacker must hold a query-capable account.

A low-privileged Grafana user who has query access to an Azure Monitor data source crafts or manipulates a query so that the Grafana server issues a server-side request to an endpoint the attacker controls. Grafana attaches the data source's Azure access token to that outbound request, and the attacker's listening endpoint captures the token, which can then be replayed against Azure APIs. No special complexity or victim interaction is required (AC:L/UI:N), but the attacker must already hold a query-capable account (PR:L); no public exploit is identified at time of analysis.