CVSS 4.0
5.3 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NCVE-2026-107365 Unintended API access through the Google Cloud Monitoring data source resource proxy
Medium (5.3) in grafana. EPSS 0.3% estimated probability of exploitation activity in the next 30 days.
On this page
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
Severity
- EPSS
- 0.3% estimated probability of exploitation activity in the next 30 days; 21st percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-441 Unintended Proxy or Intermediary (Confused Deputy)
- OWASP Top 10
- A01:2025 Broken Access Control
- Published
- Modified
- Assigned by
- GRAFANA (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-107365 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-107365?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-107365?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-107365 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-107365)
HTML:
<a href="https://cve.bz/cve/CVE-2026-107365"><img src="https://cve.bz/cve/badge/CVE-2026-107365.svg" alt="CVE-2026-107365"></a>
Affected
- grafana:(built-in) google cloud monitoring datasource
- grafana:grafana enterprise
- grafana:grafana oss
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| Grafana (built-in) Google Cloud Monitoring Datasource | from 12.4.2 before 12.6.7 |
| Grafana OSS | through 12.3.11 |
| Grafana OSS | from 12.4.0 before 12.4.15 |
| Grafana OSS | from 13.0.0 before 13.0.13 |
| Grafana OSS | from 13.1.0 before 13.1.10 |
| Grafana Enterprise | through 12.3.11 |
| Grafana Enterprise | from 12.4.0 before 12.4.15 |
| Grafana Enterprise | from 13.0.0 before 13.0.13 |
| Grafana Enterprise | from 13.1.0 before 13.1.10 |
Fix and patched versions
- Red Hat: fixed package versions per release
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Red Hat | hummingbird:1 | grafana13.2 | 0:13.2.5-0.1.hum1 | RHSA-2026:99114 |
From the distributions' data via OSV.dev: Red Hat Security Data © Red Hat, Inc., CC BY 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Red Hat.
Red Hat
Red Hat rates this Moderate.
This vulnerability is rated as Moderate because exploitation requires an authenticated user with permissions to query a configured Google Cloud Monitoring data source, preventing unauthenticated remote abuse. In Red Hat environments, Grafana is not configured with Google Cloud Monitoring integrations by default. The exposure is further constrained by the specific permissions assigned to the underlying data source credentials in Google Cloud.
To mitigate this vulnerability, enforce least-privilege access controls and disable credential forwarding on the Google Cloud Monitoring data source:
1. Configure the data source with service account credentials restricted strictly to read-only Cloud Monitoring roles on explicitly designated Google Cloud projects.
2. Ensure that "Forward OAuth Identity" and "Workload Identity Federation" settings are disabled on the affected data source.
3. If Google Cloud Monitoring is not required, remove the data source from Grafana or restrict data source query permissions to administrative users.
Warning: If data sources are provisioned via configuration files on the host, applying changes may require restarting the service (`systemctl restart grafana-server`), which will cause a brief interruption of service. Restricting credentials will prevent users from accessing metrics outside designated projects.
| Product | Package | State | Advisory |
|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Fix deferred | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Fix deferred | |
| Red Hat Ceph Storage 7 | rhceph/grafana-rhel9 | Fix deferred | |
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Fix deferred | |
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Fix deferred | |
| Red Hat Enterprise Linux 10 | grafana | Fix deferred | |
| Red Hat Enterprise Linux 10 | rhel10/grafana | Fix deferred | |
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | |
| Red Hat Enterprise Linux 9 | grafana | Fix deferred | |
| Red Hat Enterprise Linux 9 | rhel9/grafana | Fix deferred | |
| Red Hat Hardened Images | grafana12.4 | Affected | |
| Red Hat Hardened Images | grafana13.1 | Affected | |
| Red Hat Hardened Images | grafana13.2 | Affected | |
| Red Hat Hardened Images | hi/grafana | Not affected |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-107365.
Attack patterns (CAPEC)
- CAPEC-219 XML Routing Detour Attacks Likelihood: High · Severity: Medium
- CAPEC-465 Transparent Proxy Abuse Severity: Medium
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.