# CVE-2026-107365: Grafana Cloud Monitoring plugin resource proxy bypass

Source: https://junglewise.ai/threats/cve-2026-107365-a-user-with-query-access-to-a-google-cloud-monitoring-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-107365 · Severity: info · Published 2026-11-12

The Google Cloud Monitoring plugin for Grafana allows users with query access to bypass restrictions and make requests to other Cloud Monitoring API endpoints using the data source's stored credentials. An attacker could read sensitive monitoring data from any Google Cloud project that the compromised credentials can access, potentially exposing metrics, logs, and other observability data.

Vendors: [Grafana](https://junglewise.ai/threats/vendors/grafana).

## Quick answers

**Is CVE-2026-107365 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107365 being exploited in the wild.

**How severe is CVE-2026-107365?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** Grafana Cloud Monitoring plugin before 12.6.7.

**Is there a fix for CVE-2026-107365?** Yes: fixed in Cloud Monitoring plugin 12.6.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107365 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107365?** Check whether you run Grafana Cloud Monitoring plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Cloud Monitoring plugin 12.6.7

## Technical details

A privilege escalation vulnerability in the Cloud Monitoring plugin's resource proxy allows authenticated users to forge requests to arbitrary Cloud Monitoring API paths with the data source's service account or federated credentials. The vulnerability requires prior access to a Cloud Monitoring data source within Grafana; an attacker then manipulates the proxy to extract data beyond their intended scope, exploiting the plugin's failure to restrict API endpoints accessed through its credential mechanism.

## Affected products

- Grafana Cloud Monitoring plugin before 12.6.7

## Timeline

- 2026-11-12: disclosed

## References

- [https://grafana.com/security/security-advisories/cve-2026-107365](https://grafana.com/security/security-advisories/cve-2026-107365)