ケイ | IT・セキュリティ系Webライター@Teeeda_worker
【重要】GrafanaにCVSS 8.9のSSO設定の認可不備、13.2.5以降への更新と機能トグルの確認を https://www.cybernote.click/2026/10/30/grafana-cve-2026-103506-sso-settings-authorization-bypass/ #IT #Security #cybersecurity
0000038
205 followersView on X
CVE-2026-103506
LOWCVSS 8.9 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-285
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day