Description
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 13.2.0 – ≤ 13.2.4 | — |
| Grafana | Grafana OSS | 13.2.0 – ≤ 13.2.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.13-0.5.hum1 | RHSA-2026:91292 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.8-0.5.hum1 | RHSA-2026:91181 |
Advisories 3
- RHSA-2026:91181 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:91292 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4237 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-103506 vendor-advisory