High 8.9Published Oct 28, 2026

CVE-2026-103506SSO settings authorization bypass

Updated under an hour ago (Oct 29, 2026, 3:30 PM ET)

Does this affect you?

It affects Grafana Enterprise and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.27%, higher than 19% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Grafana Enterprise Exploited in the last 30 days

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

CVSS: 8.9 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
Weakness (CWE): CWE-285
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.27% (percentile 19)
Assigned by: GRAFANA
NVD analysis: Awaiting Analysis
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

Grafana Grafana Enterprise grafana:enterprise (from the name)	from 13.2.0 through 13.2.4	CNA record
Grafana Grafana OSS grafana:oss (from the name)	from 13.2.0 through 13.2.4	CNA record

References

References

https://grafana.com/security/security-advisories/cve-2026-103506	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.