Bug 2563425 - CVE-2026-103506 grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled [fedora-44]
Summary: CVE-2026-103506 grafana: SSO secrets readable by low-privileged users when an...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: grafana
Version: 44
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: sfeifer
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["51210ad0-874b-44b6-b755-9...
Depends On:
Blocks: CVE-2026-103506
TreeView+ depends on / blocked
 
Reported: 2026-10-29 15:23 UTC by Srikanth Balasubramanian
Modified: 2026-10-31 15:31 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-10-31 15:31:40 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Srikanth Balasubramanian 2026-10-29 15:23:27 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Short description of the vulnerability: 

In Grafana 13.2 with the experimental kubernetesSsoSettingsApi feature toggle enabled, a signed-in user with the Viewer role could read SSO client secrets and change SSO settings. The toggle is off by default. The fixed version enforces the SSO settings permissions on this API. 

Known mitigations: 

Keep the kubernetesSsoSettingsApi feature toggle disabled, which is the default. If you enabled it, disable it and rotate your SSO client secrets. 

Affected products and versions: 

Grafana and Grafana Enterprise 13.2.0 to 13.2.4, only with the kubernetesSsoSettingsApi feature toggle enabled. Grafana 13.1 and earlier are not affected. 

Affected platforms: 

Self-managed (on-premise)
Comment 1 Jan Kurik 2026-10-31 15:31:40 UTC 
Upstream lists only Grafana 13.2.0 as affected (SSO client secret exposure via an experimental feature added in 13.2). This branch ships Grafana 10.2.6, which predates that feature.
Note You need to log in before you can comment on or make changes to this bug.