What is the CVSS score of CVE-2026-14199?

CVE-2026-14199 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Grafana are affected by CVE-2026-14199?

Self-managed Grafana instances using authentication proxy with identity caching are vulnerable to privilege escalation, allowing authenticated users to impersonate administrators and gain full access…. A patch is available.

How to fix or mitigate CVE-2026-14199?

Within 24 hours, audit all self-managed Grafana deployments to determine whether Auth Proxy and identity caching are both enabled-exploitation requires this non-default configuration. Over the next 7 days, implement compensating controls by disabling identity caching in your authentication proxy if operationally feasible, restricting Grafana administrator role membership to essential personnel only, and enabling audit logging with real-time alerts for any role escalations. Within 30 days, monitor Grafana security advisories and release notes closely; upgrade immediately when a patched version is released and conduct a comprehensive audit of administrative account activity during the interim period to detect any unauthorized privilege escalations that may have occurred.

Grafana CVE-2026-14199

EUVD-2026-70198 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-09-02 security@grafana.com

GHSA-9758-8g25-vw94

Authentication Bypass Grafana

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (grafana) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-exploitable cache collision requiring prior authentication (PR:L) and timing plus attribute-crafting complexity (AC:H); no direct availability impact from the bypass itself.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (grafana).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 18:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 18:37 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 18:37 NVD

7.1 (HIGH) 8.1 (HIGH)

Analysis Generated

Sep 02, 2026 - 16:34 vuln.today

CVE Published

Sep 02, 2026 - 16:17 cve.org

HIGH 7.1

DescriptionNVD

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

AnalysisAI

Authentication bypass in self-managed Grafana allows a low-privileged, already-authenticated user to be resolved as a different — potentially higher-privileged — user, up to Grafana Administrator, when Auth Proxy authentication is combined with identity caching (sync_ttl greater than zero). The flaw is a cache-key collision: the identity cache concatenated the username and forwarded proxy attributes without a delimiter, so crafted attribute values can produce the same key as a victim's cached entry. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, audit all self-managed Grafana deployments to determine whether Auth Proxy and identity caching are both enabled-exploitation requires this non-default configuration. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grafana

View all

CVE-2023-34111 CRITICAL Act Now POC

9.8 Jun 06

The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili

CVE-2022-26148 CRITICAL Act Now POC

9.8 Mar 21

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this

CVE-2020-27846 CRITICAL Act Now POC

9.8 Dec 21

A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2018-15727 CRITICAL Act Now POC

9.8 Aug 29

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat

CVE-2024-9264 CRITICAL Act Now POC

9.4 Oct 18

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.

CVE-2026-63087 CRITICAL Monitor POC

9.3 Jul 16

Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok

CVE-2023-36649 CRITICAL Act Now POC

9.1 Dec 12

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re

CVE-2025-4123 HIGH This Week POC

7.6 May 22

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire

CVE-2020-13379 HIGH This Week POC

8.2 Jun 03

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS

CVE-2023-1387 HIGH This Week POC

7.5 Apr 26

Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability

CVE-2022-32276 HIGH This Week POC

7.5 Jun 17

Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (

CVE-2022-32275 HIGH This Week POC

7.5 Jun 06

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all

CVE-2024-54085 CRITICAL

9.8

CVE-2023-50224 MEDIUM

6.5

CVE-2024-4358 CRITICAL POC

9.8

CVE-2018-5353 CRITICAL POC

9.8

CVE-2023-51350 CRITICAL POC

9.8

CVE-2022-3180 CRITICAL

9.8

CVE-2025-66570 CRITICAL POC

10.0

CVE-2025-49002 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Manager Client Tools 15	Affected
SUSE Manager Client Tools for SLE 15	Affected
SUSE Multi-Linux Manager Client Tools for SLE 15	Affected

CVE-2026-14199 vulnerability details – vuln.today

Back

Grafana CVE-2026-14199

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Unlock full vulnerability intelligence

Recommended ActionAI

More in Grafana

Same weakness CWE-290 – Authentication Bypass by Spoofing

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code