Vulnerability · Published Oct 28, 2026 · Assigned by GRAFANA
CVE-2026-103506SSO settings authorization bypass
High 8.9
In plain English
A high-severity security flaw in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | 13.2.0 – through 13.2.4 |
| Grafana | Grafana OSS | 13.2.0 – through 13.2.4 |
Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
References
- https://grafana.com/security/security-advisories/cve-2026-103506 vendor-advisory