Vulnerability · Published Oct 28, 2026 · Assigned by GRAFANA
CVE-2026-88967Azure Monitor access token disclosure via SSRF
High 7.7
In plain English
A high-severity server-side request forgery in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | grafana | 12.4.14-r0 | ALPINE-CVE-2026-88967 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | 10.0.0 – through 11.6.1612.0.0 – through 12.2.1012.3.0 – through 12.3.1112.4.0 – through 12.4.1313.0.0 – through 13.0.1113.1.0 – through 13.1.813.2.0 – through 13.2.4 |
| Grafana | Grafana OSS | 10.0.0 – through 11.6.1612.0.0 – through 12.2.1012.3.0 – through 12.3.1112.4.0 – through 12.4.1313.0.0 – through 13.0.1113.1.0 – through 13.1.813.2.0 – through 13.2.4 |
Weakness: CWE-918, CWE-20, CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://grafana.com/security/security-advisories/cve-2026-88967 vendor-advisory