CVE-2026-88967

Published 28 October 2026 · tracked since 29 October 2026

Description

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-118683 HIGH 8.8
• CVE-2026-118680 MEDIUM 4.4
• CVE-2026-118645 HIGH 8.7
• CVE-2026-118265 MEDIUM 5.3
• CVE-2026-118641 HIGH 7.5
• CVE-2026-118257 HIGH 7.2
• CVE-2026-106484 MEDIUM 4.4
• CVE-2026-79656 MEDIUM 6
• CVE-2026-110181 MEDIUM 6.5
• CVE-2026-105620 MEDIUM 6.5

→ Open the live CVE board · all tools