UBUNTU-CVE-2026-103506: High severity ubuntu/grafana vulnerability
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Affected Software
Frequently Asked Questions
Which deployments are exposed?
Grafana OSS and Enterprise 13.2 installations are affected only when the experimental kubernetesSsoSettingsApi feature toggle is enabled. The feature is disabled by default.
What access does an attacker need?
An attacker must be an authenticated Grafana user. No user interaction is required, and the issue allows access to SSO client secrets and modification of instance-wide SSO settings without the intended permissions.
What is the immediate mitigation if patching is not available?
Disable the experimental kubernetesSsoSettingsApi feature toggle. This removes the affected condition described for Grafana 13.2.