Bug 2565163 (CVE-2026-107365)

Summary:	CVE-2026-107365 grafana: GOOGLE CLOUD MONITORING DATA SOURCE COULD REACH OTHER CLOUD MONITORING API PATHS
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Grafana. An authenticated user with query permissions can redirect Google Cloud Monitoring data source requests to unauthorized API endpoints. This issue can lead to information disclosure by exposing sensitive data across accessible cloud projects, and may allow unauthorized modifications depending on the permissions of the configured credentials.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-11-10

Description OSIDB Bzimport 2026-11-02 13:01:40 UTC

CVE-2026-107365: GOOGLE CLOUD MONITORING DATA SOURCE COULD REACH OTHER CLOUD MONITORING API PATHS

Score: 5.3 (MEDIUM) 

Short description of the vulnerability: 

A signed-in user who could query a Google Cloud Monitoring data source, including a Viewer, could redirect the data source's resource calls to other Cloud Monitoring API paths, for any project the data source's credentials can reach, and read data the data source does not normally expose. When the data source uses Forward OAuth Identity or Workload Identity Federation, write requests may also be possible, depending on the permissions of the forwarded credential. The fixed versions validate the target path of these calls. 

Known mitigations: 

Use credentials limited to read-only Cloud Monitoring access on the intended projects only, and avoid Forward OAuth Identity and Workload Identity Federation on this data source. 

Affected products and versions: 

Grafana and Grafana Enterprise 12.4.0 to 12.4.14, 13.0.0 to 13.0.12 and 13.1.0 to 13.1.9 (built-in data source). Versions 10.1.0 to 12.3.11 are also affected; they are end of life and will not receive a fix. On Grafana 13.2 and later the fix ships in the Google Cloud Monitoring data source plugin; see the plugin section. 

Affected platforms: 

Self-managed (on-premise)