CVE-2026-14199: Session takeover via Auth Proxy cache key collision
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (syncttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
Other sources
Reported by Grafana Labs via private security advisory (Jira PSIRTSUPT-22206), received 2026-08-20. CVSS 7.1 (High) per upstream.
Affected products and versions: Grafana OSS and Grafana Enterprise, all supported versions up to and including 11.6.16, 12.4.5, 13.1.0 (OnPrem). On-premise only; Grafana Cloud is not affected (Cloud does not use Auth Proxy header authentication).
Fixed in Grafana's private security releases: 12.3.11+security-01, 12.4.9+security-01, 13.0.7+security-01, 13.1.4+security-01, 13.2.0+security-01. Public fix expected at least 14 calendar days after 2026-08-20 per upstream embargo terms.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/grafanato a version that resolves this vulnerability.Fixed in 12.4.14-r0 - Upgrade
Upgrade
Grafana OSS and Grafana Enterpriseto a version that resolves this vulnerability.Fixed in 12.3.11+security-01 - Upgrade
Upgrade
Grafana OSS and Grafana Enterpriseto a version that resolves this vulnerability.Fixed in 12.4.9+security-01 - Upgrade
Upgrade
Grafana OSS and Grafana Enterpriseto a version that resolves this vulnerability.Fixed in 13.0.7+security-01 - Upgrade
Upgrade
Grafana OSS and Grafana Enterpriseto a version that resolves this vulnerability.Fixed in 13.1.4+security-01 - Upgrade
Upgrade
Grafana OSS and Grafana Enterpriseto a version that resolves this vulnerability.Fixed in 13.2.0+security-01
Event History
Frequently Asked Questions
Which deployments are exposed?
Only self-managed Grafana instances using Auth Proxy authentication with identity caching enabled are affected. Identity caching is enabled when sync_ttl is greater than zero.
What does an attacker need to exploit this?
The attacker must already be authenticated and able to shape their own forwarded identity attributes. Exploitation also requires a higher-privileged user’s matching cache entry to be live at the time of the collision.
What can be done if patching is not immediately possible?
Disable Auth Proxy identity caching by setting sync_ttl to zero, or stop using Auth Proxy authentication. The affected condition requires both Auth Proxy and a sync_ttl greater than zero.
How can administrators determine whether they are currently affected?
Review the Grafana authentication configuration for Auth Proxy usage and check whether sync_ttl is set above zero. If either Auth Proxy is not used or sync_ttl is zero, the instance is not affected according to the advisory details.