PT-2026-128230

CVE-2026-103506

·

Published

2026-10-28

·

Updated

2026-10-28

Description by

CVSS 4.0
8.9
High
MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-285: Improper Authorization
Related identifiers
CVE-2026-103506
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com