Path Traversal Vulnerability in Grafana's Prometheus Data Source
CVE-2026-106472

6.3MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Oss
Grafana Enterprise
Prometheus Datasource
Vendor
CVE Published:
12 November 2026

What is CVE-2026-106472?

Grafana's Prometheus data source is vulnerable due to its failure to implement a proper path allowlist for the resource path supplied by the caller. This oversight enables authorized users to exploit the data source, potentially accessing unauthorized API endpoints on the Prometheus server using the data source's credentials. As a result, this could lead to unauthorized data exposure and compromise the integrity of the system.

Affected Version(s)

Grafana Enterprise 9.1.0 <= 11.6.16

Grafana Enterprise 12.0.0 <= 12.2.10

Grafana Enterprise 12.3.0 <= 12.3.11

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.