Medium severity6.3NVD Advisory· Published Nov 12, 2026· Updated Nov 12, 2026

CVE-2026-106472

Description

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.

Affected products

Grafana/Prometheus data sourcellm-fuzzy

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-106472nvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000