Authorization Flaw in Grafana Affects User Permissions and Secret Management
CVE-2026-103506

8.9HIGH

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
28 October 2026

What is CVE-2026-103506?

An issue in Grafana allows authenticated users to improperly read Single Sign-On (SSO) client secrets and alter instance-wide SSO settings without sufficient permissions. This flaw is present in both Grafana OSS and Enterprise versions 13.2 when the experimental 'kubernetesSsoSettingsApi' feature toggle is enabled, potentially compromising user security and application integrity.

Affected Version(s)

Grafana Enterprise 13.2.0 <= 13.2.4

Grafana OSS 13.2.0 <= 13.2.4

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kazuki-hanai
.