# Grafana Cloud: Trust page changed

> Grafana Cloud added four security advisories: three High-severity issues involving alerting contact points, Azure Monitor token disclosure and SSO settings, plus a Medium-severity server-side expression parser denial of service. Customers using these capabilities have new security notices to review;

Canonical: https://rewindex.com/change/p10357
Last updated: 2026-10-29T08:44:50Z

**Summary:** Grafana Cloud added four security advisories: three High-severity issues involving alerting contact points, Azure Monitor token disclosure and SSO settings, plus a Medium-severity server-side expression parser denial of service. Customers using these capabilities have new security notices to review; four older advisories were removed from the displayed list, which does not establish that those issues were resolved. _(machine-written, sol)_
- Kind: Trust / security · Label: Changed (not classified) (rule)
- Changed: 2026-10-29 08:44 UTC · Detected: 2026-10-29 08:44 UTC
- [Source: https://grafana.com/security](https://grafana.com/security)
- [Company: Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)
- Versions: before page\_version:6905 → after page\_version:10357
- Change 3 of 4 for this page

## What changed

**1. Added**

```diff
  …records Published CVE Severity (CVSS) Advisory Title ‹date›
+ CVE-2026-100105 High (7.7) Alerting contact point authorization bypass via schema downgrade ‹date› CVE-2026-88967 High (7.7) Azure Monitor access token disclosure via SSRF ‹date› CVE-2026-88858 Medium (6.5) Server-side expression parser denial of service ‹date› CVE-2026-103506 High (8.9) SSO settings authorization bypass
  ‹date› CVE-2026-93294 Medium (6.3) Azure Monitor data source…
```

**2. Removed**

```diff
  …allows calls to arbitrary Azure Resource Manager APIs
- ‹date› CVE-2026-92539 Medium (6.7) Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise ‹date› CVE-2026-15577 Medium (6.5) Git Sync connection configuration can be modified with read-only access ‹date› CVE-2026-95502 Medium (5.3) Git Sync memory exhaustion via a malicious Git server ‹date› CVE-2026-33374 Medium (6.5) Unbounded memory allocation in the Prometheus rule conversion API
  View all security advisories Security Hall of Fame…
```

**3. Added**

```diff
  …Recent researcher credits for responsibly disclosed vulnerabilities. ‹date›
+ CVE-2026-88967 Responsibly disclosed by rathina ‹date› CVE-2026-103506 Responsibly disclosed by kazuki-hanai
  ‹date› CVE-2026-76154 Responsibly disclosed by Eric Sowah Badger…
```

**4. Removed**

```diff
  …Lab, SeoulTech ‹date› CVE-2026-13719 Responsibly disclosed by mon3m
- ‹date› CVE-2026-81842 Responsibly disclosed by Dohyun Choi, CIS Lab, SeoulTech ‹date› CVE-2026-11817 Responsibly disclosed by Harish Kolla
  View the full Hall of Fame Security Notices…
```

## History of this page

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-21 08:45 UTC | [Trust page changed](https://rewindex.com/change/p4413.md) | Changed (not classified) |
| 2026-10-24 08:45 UTC | [Trust page changed](https://rewindex.com/change/p6905.md) | Changed (not classified) |
| 2026-10-29 08:44 UTC | Trust page changed (this change) | Changed (not classified) |
| 2026-11-04 08:44 UTC | [Trust page changed](https://rewindex.com/change/p14516.md) | Changed (not classified) |

Previous: [change](https://rewindex.com/change/p6905.md) · Next: [change](https://rewindex.com/change/p14516.md) · All Grafana Cloud changes: [timeline](https://rewindex.com/company/grafana-cloud/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._

## Cite this

Trust page changed on Grafana Cloud’s Trust page, changed 2026-10-29 08:44 UTC (change 3 of 4).

- Canonical URL: https://rewindex.com/change/p10357
- Citation: Grafana Cloud, “Trust page changed” (2026-10-29 08:44 UTC). Archived by Rewindex: https://rewindex.com/change/p10357 (CC BY 4.0).
- Markdown link: `[Grafana Cloud: Trust page changed (2026-10-29)](https://rewindex.com/change/p10357)`


---
Canonical: https://rewindex.com/change/p10357 · Markdown: https://rewindex.com/change/p10357.md · JSON: https://rewindex.com/api/v1/changes/p10357 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T14:40:35.577Z