CVE-2026-103506: SSO settings authorization bypass
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the experimental kubernetesSsoSettingsApi feature toggle; it is enabled in affected installations and disabled by default.
Grafana OSS and Enterprise 13.2 kubernetesSsoSettingsApi = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Grafana OSS and Enterprise 13.2 installations are affected only when the experimental kubernetesSsoSettingsApi feature toggle is enabled. The toggle is disabled by default.
What access does an attacker need?
An attacker must already be authenticated to Grafana. No required Grafana permissions are needed to read SSO client secrets or modify instance-wide SSO settings once the affected feature is enabled.
What can be changed or disclosed through the bypass?
An authenticated user can read SSO client secrets and modify SSO settings that apply across the Grafana instance.
What can be done if patching is not immediately possible?
Disable the experimental kubernetesSsoSettingsApi feature toggle. Installations where it remains disabled are not affected according to the available information.