# CVE-2026-103506: Grafana SSO settings authorization bypass

Source: https://junglewise.ai/threats/cve-2026-103506-an-authenticated-user-in-grafana-can-read-sso-client-secrets-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-103506 · Severity: info · Published 2026-10-28

Grafana, a monitoring and observability platform, contains a flaw that allows authenticated users to access SSO (single sign-on) secrets and change organization-wide SSO configuration without proper permission checks. This could allow a user to intercept authentication credentials or modify how employees log into Grafana. The issue only affects deployments with a specific experimental feature enabled.

Technologies: [Grafana Enterprise](https://junglewise.ai/threats/technologies/grafana-grafana-enterprise), [Grafana OSS](https://junglewise.ai/threats/technologies/grafana-grafana-oss). Vendors: [Grafana](https://junglewise.ai/threats/vendors/grafana).

## Quick answers

**Is CVE-2026-103506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103506 being exploited in the wild.

**How severe is CVE-2026-103506?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Grafana Enterprise 13.2; Grafana OSS 13.2.

**Is there a fix for CVE-2026-103506?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103506 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103506?** Check whether you run Grafana Enterprise or Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated user can bypass authorization checks in the Kubernetes SSO settings API (when the kubernetesSsoSettingsApi feature toggle is enabled) to read SSO client secrets and modify instance-wide SSO settings. The vulnerability stems from missing authorization validation on API endpoints. An attacker with any authenticated user account can exploit this; no additional privileges are required.

## Affected products

- Grafana Grafana OSS 13.2
- Grafana Grafana Enterprise 13.2

## Timeline

- 2026-10-28: disclosed

## References

- [https://grafana.com/security/security-advisories/cve-2026-103506](https://grafana.com/security/security-advisories/cve-2026-103506)

## Related threats

- [Grafana authorization bypass in dashboard snapshots](https://junglewise.ai/threats/cve-2026-33379-a-user-with-any-role-including-viewer-or-a-service-account-with)
- [Grafana SCIM API insecure direct object reference across organizations](https://junglewise.ai/threats/cve-2026-92539-a-service-account-with-user-management-permissions-in-one)
- [Grafana data source proxy authorization bypass in Loki rules API](https://junglewise.ai/threats/cve-2026-9703-grafana-s-data-source-proxy-did-not-apply-role-based-access)