CVE-2026-103506: SSO Settings Authorization Bypass in Grafana

CVE-2026-103506 is an authorization bypass vulnerability affecting Grafana OSS and Enterprise version 13.2. An authenticated user can read SSO client secrets and modify instance-wide SSO settings without the required permissions. The flaw is tied to the 'kubernetesSsoSettingsApi' feature toggle, which is disabled by default. Administrators must have explicitly enabled this feature to be exposed to the risk.

The assigned CVSS score is 8.9, placing it in the HIGH severity band according to standard severity metrics. However, official data lists severity as 'medium', creating a discrepancy to verify through Grafana security advisories. The vulnerability was published on October 28, 2026. Social media signals remain limited (1 post in the last 24 hours, 8 total interactions), suggesting early awareness but not yet widespread. No public exploit repositories are known.

For IT teams and system administrators: first, verify whether the 'kubernetesSsoSettingsApi' feature toggle is enabled in your Grafana 13.2 instances. If disabled (the default configuration), risk is contained. If enabled, immediately review audit logs for unauthorized access to SSO secrets and SSO settings. Consult official Grafana security advisories for available patches and plan upgrades accordingly. Meanwhile, restrict administrative access to SSO configurations and monitor for anomalous behavior.