High severityNVD Advisory· Published Oct 28, 2026

CVE-2026-103506

Description

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

Affected products

Grafana/Grafanallm-fuzzy
Range: <13.2

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-103506nvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000