CVE-2026-14199: Session takeover via Auth Proxy cache key collision
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (syncttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Only self-managed Grafana instances using Auth Proxy authentication with identity caching enabled are affected. Identity caching is enabled when sync_ttl is greater than zero.
What does an attacker need to exploit this?
The attacker must already be authenticated and able to shape their own forwarded identity attributes. Exploitation also requires a higher-privileged user’s matching cache entry to be live at the time of the collision.
What can be done if patching is not immediately possible?
Disable Auth Proxy identity caching by setting sync_ttl to zero, or stop using Auth Proxy authentication. The affected condition requires both Auth Proxy and a sync_ttl greater than zero.
How can administrators determine whether they are currently affected?
Review the Grafana authentication configuration for Auth Proxy usage and check whether sync_ttl is set above zero. If either Auth Proxy is not used or sync_ttl is zero, the instance is not affected according to the advisory details.