A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Nov 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7. | |
| Title | Unintended API access through the Google Cloud Monitoring data source resource proxy | |
| Weaknesses | CWE-441 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GRAFANA
Published:
Updated: 2026-11-12T17:40:38.119Z
Reserved: 2026-10-07T20:22:10.028Z
Link: CVE-2026-107365
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses