Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Prometheus Datasource by Grafana
CVE-2026-106472 (GCVE-0-2026-106472)
Vulnerability from nvd – Published: 2026-11-12 17:40 – Updated: 2026-11-12 17:40
VLAI
EPSS
VEX
Title
Server-side request forgery in the Prometheus data source resource API
Summary
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.
Severity
6.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
9.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) Affected: 13.0.0 , < 13.0.13 (semver) Affected: 13.1.0 , < 13.1.10 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
9.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) Affected: 13.0.0 , < 13.0.13 (semver) Affected: 13.1.0 , < 13.1.10 (semver) |
|
| Grafana | Prometheus Datasource |
Affected:
13.1.1 , ≤ 13.1.9
(semver)
Affected: 13.2.0 , < 13.2.6 (semver) |
Date Public
2026-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prometheus Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.1",
"versionType": "semver"
},
{
"lessThan": "13.2.6",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana\u0027s Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source\u0027s credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:40:38.018Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-106472"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Server-side request forgery in the Prometheus data source resource API"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-106472",
"datePublished": "2026-11-12T17:40:38.018Z",
"dateReserved": "2026-10-06T17:52:02.983Z",
"dateUpdated": "2026-11-12T17:40:38.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106472 (GCVE-0-2026-106472)
Vulnerability from cvelistv5 – Published: 2026-11-12 17:40 – Updated: 2026-11-12 17:40
VLAI
EPSS
VEX
Title
Server-side request forgery in the Prometheus data source resource API
Summary
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.
Severity
6.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
9.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) Affected: 13.0.0 , < 13.0.13 (semver) Affected: 13.1.0 , < 13.1.10 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
9.1.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.15 (semver) Affected: 13.0.0 , < 13.0.13 (semver) Affected: 13.1.0 , < 13.1.10 (semver) |
|
| Grafana | Prometheus Datasource |
Affected:
13.1.1 , ≤ 13.1.9
(semver)
Affected: 13.2.0 , < 13.2.6 (semver) |
Date Public
2026-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prometheus Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.1",
"versionType": "semver"
},
{
"lessThan": "13.2.6",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana\u0027s Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source\u0027s credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:40:38.018Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-106472"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Server-side request forgery in the Prometheus data source resource API"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-106472",
"datePublished": "2026-11-12T17:40:38.018Z",
"dateReserved": "2026-10-06T17:52:02.983Z",
"dateUpdated": "2026-11-12T17:40:38.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}