https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T17:28:29.279432+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-107365 CVE-2026-107365 — Unintended API access through the Google Cloud Monitoring data source resource proxy 2026-11-14T17:28:29.290204+00:00

Affected: Grafana (built-in) Google Cloud Monitoring Datasource, Grafana OSS, Grafana Enterprise

A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.