{"id":"CVE-2026-103506","aliases":[],"cve":{"records":[{"id":"CVE-2026-103506","source":"GRAFANA","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-30T17:37:32.552Z","published":"2026-10-28T16:50:30.111Z","modified":"2026-10-28T16:50:30.111Z"}],"publishers":[{"name":"GRAFANA","role":"CNA","organizationId":"57da9224-a3e2-4646-9d0e-c4dc2e05e7da","modified":"2026-10-28T16:50:30.111Z"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-103506","tags":["vendor-advisory"],"source":"GRAFANA"}],"weaknesses":[{"id":"CWE-285","description":"CWE-285","source":"GRAFANA"}],"applicability":[],"prioritization":[]},"title":"SSO settings authorization bypass","titleSource":"GRAFANA","descriptionSource":"GRAFANA","description":"An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.","score":8.9,"severity":"high","published":"2026-10-28T16:50:30.111Z","modified":"2026-10-28T16:50:30.111Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Grafana","name":"Grafana Enterprise","platforms":[],"versions":[{"version":"13.2.0","status":"affected","lessThanOrEqual":"13.2.4","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"GRAFANA","url":"https://www.cve.org/CVERecord?id=CVE-2026-103506"},{"vendor":"Grafana","name":"Grafana OSS","platforms":[],"versions":[{"version":"13.2.0","status":"affected","lessThanOrEqual":"13.2.4","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"GRAFANA","url":"https://www.cve.org/CVERecord?id=CVE-2026-103506"}],"remediation":[],"references":["https://grafana.com/security/security-advisories/cve-2026-103506"],"sources":[{"name":"CVE","id":"CVE-2026-103506","modified":"2026-10-28T16:50:30.111Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-103506"}],"assessments":[{"source":"GRAFANA","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","score":8.9}],"sourceAffected":[],"observedAt":"2026-10-29T14:08:53.711Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Grafana 13.2 installations with the kubernetesSsoSettingsApi feature toggle enabled are affected by an authorization bypass, allowing authenticated users to read SSO client secrets and modify instance-wide SSO settings without required permissions. This affects Grafana OSS and Enterprise versions 13.2.0 through 13.2.4. An attacker needs authenticated access to exploit the weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:24:17.259Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-103506"}]}}