CVE-2026-107365
Last modified
CVE-2026-107365 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions.
Description
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Grafana | (built-in) Google Cloud Monitoring Datasource | >= 12.4.2, < 12.6.7 |
| Grafana | Grafana OSS | <= 12.3.11; >= 12.4.0, < 12.4.15; >= 13.0.0, < 13.0.13; >= 13.1.0, < 13.1.10 |
| Grafana | Grafana Enterprise | <= 12.3.11; >= 12.4.0, < 12.4.15; >= 13.0.0, < 13.0.13; >= 13.1.0, < 13.1.10 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-107365?
How severe is CVE-2026-107365?
How do I fix CVE-2026-107365?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107359Improper input validation in the beacon handler for WF200 fi…6.5
- CVE-2026-10736The Tutor LMS – eLearning and online course solution plugin …4.9
- CVE-2026-107360A flaw was found in rubygem-safemode. Compound assignment ex…9.6
- CVE-2026-107361The Arkime live capture service (arkime-live) in Malcolm run…4.2
- CVE-2026-107362The bundled FilePond PHP server in Malcolm's file-upload com…7.1
- CVE-2026-107363In OpenStack Zaqar before 23.0.1, the WebSocket transport fa…6.1
- CVE-2026-107366IBM Langflow OSS 1.0.0 through 1.12.4 contains three message…8.3
- CVE-2026-107369The auth0/nextjs-auth0 SDK validates that the returnTo param…6.1
- CVE-2026-10737The SP Project & Document Manager plugin for WordPress is vu…7.5
- CVE-2026-107370When a username for an Active Directory connection is a doma…5.3
- CVE-2026-107371When the authorize() method is called with a maxAge paramete…5.4
- CVE-2026-107372The auth0-ai-js FGA retriever does not distinguish between a…
Are you affected by CVE-2026-107365?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST