Bug 2563425

Summary:	CVE-2026-103506 grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled [fedora-44]
Product:	[Fedora] Fedora	Reporter:	Srikanth Balasubramanian <sbalasub>
Component:	grafana	Assignee:	sfeifer
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	44	CC:	go-sig, jkurik, nathans, sfeifer, wcohen
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["51210ad0-874b-44b6-b755-9b4498902323"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-31 15:31:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2554120

Description Srikanth Balasubramanian 2026-10-29 15:23:27 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Short description of the vulnerability: 

In Grafana 13.2 with the experimental kubernetesSsoSettingsApi feature toggle enabled, a signed-in user with the Viewer role could read SSO client secrets and change SSO settings. The toggle is off by default. The fixed version enforces the SSO settings permissions on this API. 

Known mitigations: 

Keep the kubernetesSsoSettingsApi feature toggle disabled, which is the default. If you enabled it, disable it and rotate your SSO client secrets. 

Affected products and versions: 

Grafana and Grafana Enterprise 13.2.0 to 13.2.4, only with the kubernetesSsoSettingsApi feature toggle enabled. Grafana 13.1 and earlier are not affected. 

Affected platforms: 

Self-managed (on-premise)

Comment 1 Jan Kurik 2026-10-31 15:31:40 UTC

Upstream lists only Grafana 13.2.0 as affected (SSO client secret exposure via an experimental feature added in 13.2). This branch ships Grafana 10.2.6, which predates that feature.