Grafana CVE-2026-103506

Exploitation requires the experimental kubernetesSsoSettingsApi feature toggle to be explicitly enabled on Grafana OSS or Enterprise 13.2.0-13.2.4; this toggle is disabled by default, so default deployments are not affected. The attacker must hold a valid authenticated Grafana account (PR:L) but does NOT need the SSO-settings permission that should normally be required - that missing authorization check is the flaw. Primary limiting factors: the non-default experimental toggle (sharply narrowing the exposed population) and the need for any authenticated session; the specific API-call mechanics beyond 'missing authorization' are not described in the available sources.

Severity signals are moderately high but materially gated by deployment reality. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N) scores 8.9 and reflects a network-reachable flaw usable by a low-privileged authenticated user (PR:L), with high confidentiality and integrity impact to both the vulnerable system (VC:H/VI:H) and subsequent systems (SC:H/SI:H) because SSO settings are instance-wide. The CWE-285 (improper authorization) classification matches the description: an authenticated user bypasses the permission check rather than any authentication control. The critical dampening signal is AT:P combined with the description's own statement that the required experimental kubernetesSsoSettingsApi feature toggle is disabled by default - so default installations are not exposed. The vuln.today Decision label is 'this_week' (not act_now/emergency). No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the supplied data, so there is no evidence of active exploitation or public exploit code. Net assessment: a legitimately high-severity authorization flaw for the subset of 13.2 instances that have manually enabled an experimental toggle, but not a widespread-exposure emergency given the non-default precondition and absence of exploitation signals. Missing data to note explicitly: EPSS probability is absent, KEV status is not confirmed (treated as not listed), and no fixed version is stated in the provided sources.

On a Grafana OSS or Enterprise 13.2 instance where an operator has enabled the experimental kubernetesSsoSettingsApi toggle, a low-privileged but authenticated user calls the SSO settings API that fails to enforce the required permission, reads stored SSO/OAuth client secrets, and rewrites instance-wide SSO configuration. By redirecting authentication to an attacker-influenced identity provider or exfiltrating client secrets, the attacker can escalate toward broader account takeover. No public exploit or PoC reference is identified at time of analysis.