Quick answers
- Is CVE-2026-103506 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103506 being exploited in the wild.
- How severe is CVE-2026-103506?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- Grafana Enterprise 13.2; Grafana OSS 13.2.
- Is there a fix for CVE-2026-103506?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-103506 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-103506?
- Check whether you run Grafana Enterprise or Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authenticated user can bypass authorization checks in the Kubernetes SSO settings API (when the kubernetesSsoSettingsApi feature toggle is enabled) to read SSO client secrets and modify instance-wide SSO settings. The vulnerability stems from missing authorization validation on API endpoints. An attacker with any authenticated user account can exploit this; no additional privileges are required.
Affected products
- Grafana Grafana OSS 13.2
- Grafana Grafana Enterprise 13.2
Timeline
- 2026-10-28: disclosed