Bug 2554120 (CVE-2026-103506)

Summary:	CVE-2026-103506 grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On (SSO) settings Application Programming Interface (API) feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this vulnerability to view sensitive SSO client secrets and modify authentication settings.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2563425, 2563428
Bug Blocks:
Deadline:	2026-10-28

Description OSIDB Bzimport 2026-10-16 13:46:16 UTC

Short description of the vulnerability: 

In Grafana 13.2 with the experimental kubernetesSsoSettingsApi feature toggle enabled, a signed-in user with the Viewer role could read SSO client secrets and change SSO settings. The toggle is off by default. The fixed version enforces the SSO settings permissions on this API. 

Known mitigations: 

Keep the kubernetesSsoSettingsApi feature toggle disabled, which is the default. If you enabled it, disable it and rotate your SSO client secrets. 

Affected products and versions: 

Grafana and Grafana Enterprise 13.2.0 to 13.2.4, only with the kubernetesSsoSettingsApi feature toggle enabled. Grafana 13.1 and earlier are not affected. 

Affected platforms: 

Self-managed (on-premise)