Grafana: Missing authorization in SSO settings API
Summary
An authenticated user in Grafana OSS and Grafana Enterprise can read SSO client secrets and change instance-wide SSO settings without the required permissions. The flaw affects only Grafana 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default. An attacker with any valid Grafana login could therefore expose SSO credentials and alter login configuration, which may enable account takeover or lock-out of users.
Affected
- Grafana OSS 13.2.0 to 13.2.4
- Grafana Enterprise 13.2.0 to 13.2.4
- Only with the experimental feature toggle kubernetesSsoSettingsApi enabled (disabled by default)
- Older branches (13.1, 13.0, 12.x): Unknown.
Fixed in
- Grafana 13.2.5 or later
- Ubuntu packages: Not in release for affected Ubuntu releases; verify with the distribution before relying on it.
Workaround
- Verify that the feature toggle kubernetesSsoSettingsApi is disabled on every instance (feature_toggles setting in grafana.ini or the matching environment variable).
- If the toggle cannot be disabled, upgrade to 13.2.5 or later.
Exploitation
- No evidence of exploitation in the wild; the aggregator reports KEV: No.
- No public proof of concept found in a limited search.
Our recommendation
- Check whether kubernetesSsoSettingsApi is enabled on all Grafana instances; if so, treat this as high priority.
- Disable the feature toggle where it is not required.
- Upgrade Grafana to 13.2.5 or later, using the upstream release if distribution packages lack the fix.
- Review users with Grafana logins and SSO configuration changes for unexpected activity.
- Rotate SSO client secrets if the feature was enabled and the instance was exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana advisory CVE-2026-103506 grafana.com
- Grafana releases on GitHub github.com
- Ubuntu CVE tracker ubuntu.com
- Grafana Hall of Fame grafana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:26.
Original description (NVD)
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.