Bug 2554120 (CVE-2026-103506) - CVE-2026-103506 grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled
Summary: CVE-2026-103506 grafana: SSO secrets readable by low-privileged users when an...
Keywords:
Status: NEW
Alias: CVE-2026-103506
Deadline: 2026-10-28
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2563425 2563428
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-16 13:46 UTC by OSIDB Bzimport
Modified: 2026-10-29 15:25 UTC (History)
19 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-16 13:46:16 UTC 
Short description of the vulnerability: 

In Grafana 13.2 with the experimental kubernetesSsoSettingsApi feature toggle enabled, a signed-in user with the Viewer role could read SSO client secrets and change SSO settings. The toggle is off by default. The fixed version enforces the SSO settings permissions on this API. 

Known mitigations: 

Keep the kubernetesSsoSettingsApi feature toggle disabled, which is the default. If you enabled it, disable it and rotate your SSO client secrets. 

Affected products and versions: 

Grafana and Grafana Enterprise 13.2.0 to 13.2.4, only with the kubernetesSsoSettingsApi feature toggle enabled. Grafana 13.1 and earlier are not affected. 

Affected platforms: 

Self-managed (on-premise)
Note You need to log in before you can comment on or make changes to this bug.