Grafana OSS EUVD-2026-30142

Exploitation requires that the target deployment (a) uses the Auth Proxy authentication provider, (b) configures its allow-list with at least one IPv6 entry written without an explicit CIDR mask, and (c) is reachable by the attacker from somewhere inside the resulting /32 IPv6 range that Grafana mistakenly trusts. Exploitation is constrained by the fact that IPv4-only Auth Proxy deployments, IPv6 entries already written with /128 (or any explicit mask), and deployments using Okta, SAML, or LDAP instead of Auth Proxy are not affected; the attacker also needs network-adjacent IPv6 positioning within the unintentionally trusted block, which is why CVSS marks attack complexity as High.

Signals are mixed but coherent: CVSS 7.4 with C:H/I:H/A:N reflects the severity of an authentication bypass leading to confidentiality and integrity loss, while AC:H accurately captures that exploitation requires a non-default but realistic misconfiguration (IPv6 deployment of Auth Proxy with mask-less entries). EPSS of 0.03% (9th percentile) and SSVC 'Exploitation: none / Automatable: no' indicate no observed in-the-wild activity, and the issue is not on the CISA KEV list - though SSVC Technical Impact is rated 'total,' consistent with full session takeover where exploitable. The realistic priority is moderate: organizations running Auth Proxy with IPv6 allow-lists and bare addresses face a serious bypass, but those using IPv4-only Auth Proxy, explicit /128 masks, or alternative auth providers (Okta, SAML, LDAP) are not exposed. No conflicting data signals were identified in the provided intelligence.

An attacker on the same IPv6 /32 block as the legitimate reverse proxy - for instance, sharing a hosting provider, cloud region, or transit network with the Grafana operator - crafts HTTP requests directly to the Grafana backend including the X-WEBAUTH-USER header with an admin username. Because the source address falls within the over-broad /32 range that Grafana treats as trusted Auth Proxy origin, the request is accepted as pre-authenticated and the attacker obtains the targeted user's session and dashboards. No public exploit identified at time of analysis.