CVE-2026-114160

Summary

A server-side request forgery (SSRF) vulnerability in Azure Managed Grafana allows unauthenticated remote attackers to manipulate the application into making unintended internal network requests, leading to privilege escalation. This occurs due to insufficient validation of user-supplied URLs used in backend HTTP requests.

Exploitability

Exploitation requires no authentication or user interaction and can be performed remotely over the network with low technical complexity, assuming the attacker can submit malicious input to a vulnerable endpoint.

Blast radius

Successful exploitation could enable full compromise of confidentiality, integrity, and availability of the affected system and potentially downstream internal services accessible to the Grafana instance.

Detection

Defenders should monitor for anomalous outbound HTTP requests from the Grafana service to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) or metadata endpoints (e.g., 169.254.169.254), especially when such requests correlate with user-initiated API calls involving URL parameters or dashboard imports.

Prioritized remediation

Upgrade to Azure Managed Grafana version 2.590 or later, as this is the minimum version that includes the fix for CVE-2026-114160.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.