Vulnerability Bulletins |
CVE-2026-106472 |
|
| Affected software | GRAFANA |
| Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-106472 | |