UpHeron
All vulnerabilities

Servers and applications

CVE-2026-107365

Unintended API access through the Google Cloud Monitoring data source resource proxy

Severity
Medium 5.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
12.4.15, 13.0.13, 13.1.10
Weakness
CWE-441
Attack
Over the network · Needs a user account · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Sources
CVE Program

Description

A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • Every version up to 12.3.11
  • From 12.4.0 before 12.4.15
  • From 13.0.0 before 13.0.13
  • From 13.1.0 before 13.1.10

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-107365