{"id":"CVE-2026-103506","kind":"vulnerability","aliases":["CVE-2026-103506"],"related":[],"title":"Grafana: authenticated users can read SSO secrets and change SSO settings","description":"An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.","summary":"An authenticated Grafana user can read SSO client secrets and modify instance-wide SSO settings without the required permissions, because the authorization check is missing. The flaw only applies when the experimental kubernetesSsoSettingsApi feature toggle is enabled, which is off by default.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grafana","oauth","runtime","self-hosted","sso"],"not_affected_if":["default-config","feature-toggle-off","managed-hosting"],"how_to_check":"- Check whether the feature toggle `kubernetesSsoSettingsApi` is set in the Grafana configuration (`[feature_toggles]` section of grafana.ini or the `GF_FEATURE_TOGGLES_ENABLE` environment variable).\n- Check the running version with `grafana --version`; the sources say 13.2 installations are affected, exact fixed versions unknown.","fix":"- Remove `kubernetesSsoSettingsApi` from the enabled feature toggles until a patched Grafana release is installed.\n- Upgrade Grafana OSS and Enterprise to a fixed 13.2 or later release; exact version unknown.\n- Rotate SSO client secrets if the feature was enabled and untrusted users had accounts.","status":"open","published_at":"2026-10-28T17:17:28+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:14+00:00","updated_at":"2026-10-28T17:34:14+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-28T17:34:14Z","model":"claude-haiku-5-5","output":{"fix":"- Remove `kubernetesSsoSettingsApi` from the enabled feature toggles until a patched Grafana release is installed.\n- Upgrade Grafana OSS and Enterprise to a fixed 13.2 or later release; exact version unknown.\n- Rotate SSO client secrets if the feature was enabled and untrusted users had accounts.","reach":"network","title":"Grafana: authenticated users can read SSO secrets and change SSO settings","impact":"high","summary":"An authenticated Grafana user can read SSO client secrets and modify instance-wide SSO settings without the required permissions, because the authorization check is missing. The flaw only applies when the experimental kubernetesSsoSettingsApi feature toggle is enabled, which is off by default.","category":"runtime","nicknames":[],"who_cares":["grafana","self-hosted","sso","oauth"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated users read SSO client secrets and alter instance-wide login settings.","analyst_note":"Sources do not list fixed Grafana versions or a patch link; check the Grafana security advisory for CVE-2026-103506 for the fixed release.","how_to_check":"- Check whether the feature toggle `kubernetesSsoSettingsApi` is set in the Grafana configuration (`[feature_toggles]` section of grafana.ini or the `GF_FEATURE_TOGGLES_ENABLE` environment variable).\n- Check the running version with `grafana --version`; the sources say 13.2 installations are affected, exact fixed versions unknown.","needs_analyst":true,"not_affected_if":["default-config","feature-toggle-off","managed-hosting"],"who_is_affected":"Only Grafana OSS and Enterprise 13.2 installations that have the experimental kubernetesSsoSettingsApi feature toggle turned on. Instances with the default configuration are not affected, and teams that never enabled that toggle can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":3320,"output_tokens":715,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103506':14A,17A '-2026':13A,16A '13.2':97C 'affect':92C 'appli':54B 'authent':2A,26B,69C 'author':47B,90C 'chang':9A 'check':48B 'client':32B,76C 'cve':12A,15A 'default':67B,110C 'disabl':108C 'enabl':62B,105C 'enterpris':96C 'experiment':57B,101C 'featur':59B,103C 'flaw':52B 'grafana':1A,18B,27B,72C,93C 'host':23B 'instal':98C 'instanc':37B,81C 'instance-wid':36B,80C 'kubernetesssosettingsapi':58B,102C 'miss':50B,89C 'modifi':35B,79C 'oauth':19B 'oss':94C 'permiss':44B,88C 'read':5A,30B,74C 'requir':43B,87C 'runtim':20B 'secret':7A,33B,77C 'self':22B 'self-host':21B 'set':11A,40B,84C 'sso':6A,10A,24B,31B,39B,75C,83C 'toggl':60B,104C 'user':3A,28B,70C 'wide':38B,82C 'without':41B,85C","nicknames":[],"mitigations":[],"who_affected":"Only Grafana OSS and Enterprise 13.2 installations that have the experimental kubernetesSsoSettingsApi feature toggle turned on. Instances with the default configuration are not affected, and teams that never enabled that toggle can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103506","severity":null,"published_at":"2026-10-28T17:17:28+00:00","modified_at":"2026-10-28T17:17:28+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}