{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107365", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-10-07T20:22:10.028Z", "datePublished": "2026-11-12T17:40:38.119Z", "dateUpdated": "2026-11-12T17:40:38.119Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "(built-in) Google Cloud Monitoring Datasource", "vendor": "Grafana", "versions": [{"lessThan": "12.6.7", "status": "affected", "version": "12.4.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.13", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.10", "status": "affected", "version": "13.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.13", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.10", "status": "affected", "version": "13.1.0", "versionType": "semver"}]}], "datePublic": "2026-11-10T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7."}], "metrics": [{"cvssV4_0": {"baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "CWE-441", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-11-12T17:40:38.119Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-107365"}], "source": {"discovery": "INTERNAL_FINDING"}, "title": "Unintended API access through the Google Cloud Monitoring data source resource proxy"}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "(built-in) Google Cloud Monitoring Datasource", "vendor": "Grafana", "versions": [{"lessThan": "12.6.7", "status": "affected", "version": "12.4.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.13", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.10", "status": "affected", "version": "13.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.13", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.10", "status": "affected", "version": "13.1.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7."}], "id": "CVE-2026-107365", "lastModified": "2026-11-12T19:09:06.967", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@grafana.com", "type": "Secondary"}]}, "published": "2026-11-12T18:17:12.880", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-107365"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: GOOGLE CLOUD MONITORING DATA SOURCE COULD REACH OTHER CLOUD MONITORING API PATHS", "id": "2565163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565163"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Grafana. An authenticated user with query permissions can redirect Google Cloud Monitoring data source requests to unauthorized API endpoints. This issue can lead to information disclosure by exposing sensitive data across accessible cloud projects, and may allow unauthorized modifications depending on the permissions of the configured credentials."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, enforce least-privilege access controls and disable credential forwarding on the Google Cloud Monitoring data source:\n1. Configure the data source with service account credentials restricted strictly to read-only Cloud Monitoring roles on explicitly designated Google Cloud projects.\n2. Ensure that \"Forward OAuth Identity\" and \"Workload Identity Federation\" settings are disabled on the affected data source.\n3. If Google Cloud Monitoring is not required, remove the data source from Grafana or restrict data source query permissions to administrative users.\nWarning: If data sources are provisioned via configuration files on the host, applying changes may require restarting the service (`systemctl restart grafana-server`), which will cause a brief interruption of service. Restricting credentials will prevent users from accessing metrics outside designated projects."}, "name": "CVE-2026-107365", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhel10/grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107365\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107365"], "statement": "This vulnerability is rated as Moderate because exploitation requires an authenticated user with permissions to query a configured Google Cloud Monitoring data source, preventing unauthenticated remote abuse. In Red Hat environments, Grafana is not configured with Google Cloud Monitoring integrations by default. The exposure is further constrained by the specific permissions assigned to the underlying data source credentials in Google Cloud.", "threat_severity": "Moderate"}