Detections
Analytics
CVE-2026-106472
medium
Description
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.
References
https://grafana.com/security/security-advisories/cve-2026-106472