Live › vulnerability › CVE-2026-103506
Go to dashboardAn authenticated Grafana user can read SSO client secrets and modify instance-wide SSO settings without the required permissions, because the authorization check is missing. The flaw only applies when the experimental kubernetesSsoSettingsApi feature toggle is enabled, which is off by default.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Only Grafana OSS and Enterprise 13.2 installations that have the experimental kubernetesSsoSettingsApi feature toggle turned on. Instances with the default configuration are not affected, and teams that never enabled that toggle can skip it.
No product ranges from the sources yet.
kubernetesSsoSettingsApi is set in the Grafana configuration ([feature_toggles] section of grafana.ini or the GF_FEATURE_TOGGLES_ENABLE environment variable).grafana --version; the sources say 13.2 installations are affected, exact fixed versions unknown.kubernetesSsoSettingsApi from the enabled feature toggles until a patched Grafana release is installed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-103506")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.