CVE-2026-103506

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103506", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-09-30T17:37:32.552Z", "datePublished": "2026-10-28T16:50:30.111Z", "dateUpdated": "2026-11-05T17:15:31.338Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "kazuki-hanai"}], "datePublic": "2026-10-27T11:34:35.000Z", "descriptions": [{"lang": "en", "value": "An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default."}], "metrics": [{"cvssV4_0": {"baseScore": 8.9, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "version": "4.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-28T16:50:30.111Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-103506"}], "source": {"discovery": "BUG_BOUNTY"}, "title": "SSO settings authorization bypass"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T17:14:54.214557Z", "id": "CVE-2026-103506", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:15:31.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T17:14:54.214557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:15:26.483Z"}}], "cna": {"title": "SSO settings authorization bypass", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "kazuki-hanai"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.9, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.4"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.4"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-27T11:34:35.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-103506", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-28T16:50:30.111Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103506", "state": "PUBLISHED", "dateUpdated": "2026-11-05T17:15:31.338Z", "dateReserved": "2026-09-30T17:37:32.552Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-10-28T16:50:30.111Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default."}], "id": "CVE-2026-103506", "lastModified": "2026-11-05T18:16:59.377", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103506", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T17:14:54.214557Z", "version": "2.0.3"}}]}, "published": "2026-10-28T17:17:28.797", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-103506"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:91181", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "grafana13-1-main-13.1.8-0.5.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-27T00:00:00Z"}, {"advisory": "RHSA-2026:91292", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "grafana12-4-main-12.4.13-0.5.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-27T00:00:00Z"}], "bugzilla": {"description": "grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled", "id": "2554120", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554120"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "status": "verified"}, "cwe": "CWE-425", "details": ["An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.", "A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On (SSO) settings Application Programming Interface (API) feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this vulnerability to view sensitive SSO client secrets and modify authentication settings."], "mitigation": {"lang": "en:us", "value": "Ensure the experimental `kubernetesSsoSettingsApi` feature toggle is disabled. By default, this feature toggle is inactive. If this feature was manually activated, remove `kubernetesSsoSettingsApi` from the `[feature_toggles]` section in the Grafana configuration file (`grafana.ini`) or from the `GF_FEATURE_TOGGLES_ENABLE` environment variable.\nApply the configuration by restarting the service:\n```\nsystemctl restart grafana-server\n```\nWarning: Restarting the `grafana-server` service will result in a temporary interruption of service for connected users. Additionally, if the toggle was previously enabled, immediately rotate all associated SSO client secrets to prevent unauthorized access from potentially exposed credentials."}, "name": "CVE-2026-103506", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103506\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103506"], "statement": "This vulnerability is rated as an Important impact because authenticated users possessing minimal viewer privileges can expose sensitive single sign-on credentials and modify authentication configurations across the platform. Such credential exposure may allow attackers to compromise downstream identity providers or escalate access within the organization. However, the risk is constrained in standard Red Hat environments because the affected API relies on an experimental feature toggle that remains deactivated by default.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-10-28T19:00:18.886689+00:00", "updated": "2026-10-30T14:45:14.965821+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}