8.9
High
CVE-2026-103506 SSO settings authorization bypass
Description
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:LExploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
- Confidentiality of other systems
- High
- Integrity of other systems
- High
- Availability of other systems
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Grafana Enterprise 13.2 | 13.2.0 → 13.2.4 | No fix stated |
| Grafana OSS 13.2 | 13.2.0 → 13.2.4 | No fix stated |
Other CVEs of Grafana Enterprise
The 41 CVEs of Grafana Enterprise →
CVE-2026-33379
Dashboard snapshot permission bypass
8.5
High
CVE-2026-79656
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
6.0
Medium
CVE-2026-88858
Server-side expression parser denial of service
6.5
Medium
CVE-2026-88967
Azure Monitor access token disclosure via SSRF
7.7
High