Bug 2521850 (CVE-2026-14199)

Summary:	CVE-2026-14199 grafana: Grafana: Session takeover via Auth Proxy cache key collision
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, vereddy, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	On instances using Auth Proxy header authentication ([auth.proxy]) with identity caching enabled (sync_ttl > 0), two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged user's cached session and act as that user for the duration of the cache TTL. Default configurations are not affected.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 12:55:10 UTC

Reported by Grafana Labs via private security advisory (Jira PSIRTSUPT-22206), received 2026-08-20. CVSS 7.1 (High) per upstream.

Affected products and versions: Grafana OSS and Grafana Enterprise, all supported versions up to and including 11.6.16, 12.4.5, 13.1.0 (OnPrem). On-premise only; Grafana Cloud is not affected (Cloud does not use Auth Proxy header authentication).

Fixed in Grafana's private security releases: 12.3.11+security-01, 12.4.9+security-01, 13.0.7+security-01, 13.1.4+security-01, 13.2.0+security-01. Public fix expected at least 14 calendar days after 2026-08-20 per upstream embargo terms.