Grafana13.2 AuthBypass: SSO client secrets read/modify via k8sSsoApi
CVE-2026-103506 Published on October 28, 2026
SSO settings authorization bypass
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Vulnerability Analysis
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-103506 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-103506
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Enterprise:- Version 13.2.0, <= 13.2.4 is affected.
- Version 13.2.0, <= 13.2.4 is affected.