CVE-2026-107365: GOOGLE CLOUD MONITORING DATA SOURCE COULD REACH OTHER CLOUD MONITORING API PATHS

Score: 5.3 (MEDIUM) 

Short description of the vulnerability: 

A signed-in user who could query a Google Cloud Monitoring data source, including a Viewer, could redirect the data source's resource calls to other Cloud Monitoring API paths, for any project the data source's credentials can reach, and read data the data source does not normally expose. When the data source uses Forward OAuth Identity or Workload Identity Federation, write requests may also be possible, depending on the permissions of the forwarded credential. The fixed versions validate the target path of these calls. 

Known mitigations: 

Use credentials limited to read-only Cloud Monitoring access on the intended projects only, and avoid Forward OAuth Identity and Workload Identity Federation on this data source. 

Affected products and versions: 

Grafana and Grafana Enterprise 12.4.0 to 12.4.14, 13.0.0 to 13.0.12 and 13.1.0 to 13.1.9 (built-in data source). Versions 10.1.0 to 12.3.11 are also affected; they are end of life and will not receive a fix. On Grafana 13.2 and later the fix ships in the Google Cloud Monitoring data source plugin; see the plugin section. 

Affected platforms: 

Self-managed (on-premise)