CVE-2026-107365
Unintended API access through the Google Cloud Monitoring data source resource proxy
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
| CWE | CWE-441 |
| Vendor | grafana |
| Product | (built-in) google cloud monitoring datasource |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for grafana (built-in) google cloud monitoring datasource
Be the first to know when new unknown vulnerabilities affecting grafana (built-in) google cloud monitoring datasource are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Grafana / (built-in) Google Cloud Monitoring Datasource
12.4.2 < 12.6.7
Grafana / Grafana OSS
0 ≤ 12.3.11 12.4.0 < 12.4.15 13.0.0 < 13.0.13 13.1.0 < 13.1.10
Grafana / Grafana Enterprise
0 ≤ 12.3.11 12.4.0 < 12.4.15 13.0.0 < 13.0.13 13.1.0 < 13.1.10