HIGH 8.9 NVD

CVE-2026-103506

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). Thi

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

References

https://grafana.com/security/security-advisories/cve-2026-103506

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This high severity vulnerability with a CVSS score of 8.9 was published on 2026-10-28 via NVD.

vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.