CVE-2026-14199
published 2026-09-02CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache…
PriorityP356high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.31%
22.8th percentile
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | < 11.0.0 | 11.0.0 |
| grafana | grafana | — | — |
| grafana | grafana | >= 12.4.10 < 13.0.0 | 13.0.0 |
| grafana | grafana | >= 13.0.8 < 13.1.0 | 13.1.0 |
| grafana | grafana | >= 13.1.5 < 13.2.0 | 13.2.0 |
| grafana | grafana_enterprise | 11.0.0 – 11.6.17 | — |
| grafana | grafana_enterprise | 12.0.0 – 12.2.11 | — |
| grafana | grafana_enterprise | 12.3.0 – 12.3.11 | — |
| grafana | grafana_enterprise | 12.4.0 – 12.4.9 | — |
| grafana | grafana_enterprise | 13.0.0 – 13.0.7 | — |
| grafana | grafana_enterprise | 13.1.0 – 13.1.4 | — |
| grafana | grafana_enterprise | 13.2.0 – 13.2.0 | — |
| grafana | grafana_oss | 11.0.0 – 11.6.17 | — |
| grafana | grafana_oss | 12.0.0 – 12.2.11 | — |
| grafana | grafana_oss | 12.3.0 – 12.3.11 | — |
| grafana | grafana_oss | 12.4.0 – 12.4.9 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.7 | — |
| grafana | grafana_oss | 13.1.0 – 13.1.4 | — |
| grafana | grafana_oss | 13.2.0 – 13.2.0 | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
| rhceph | rhceph-5-dashboard-rhel8 | — | — |
| rhceph | rhceph-6-dashboard-rhel9 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: Grafana: Session takeover via Auth Proxy cache key collision
vendor_redhat·2026-09-02·CVSS 7.1
CVE-2026-14199 [HIGH] CWE-639 grafana: Grafana: Session takeover via Auth Proxy cache key collision
grafana: Grafana: Session takeover via Auth Proxy cache key collision
On instances using Auth Proxy header authentication ([auth.proxy]) with identity caching enabled (sync_ttl > 0), two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged user's cached session and act as that user for the duration of the cache TTL. Default configurations are not affected.
Mitigation: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable).
Package: multicluster-g
VulDB
Grafana Enterprise/OSS up to 13.2.0 Auth Proxy privileges management
vuldb·2026-09-02·CVSS 7.1
CVE-2026-14199 [HIGH] Grafana Enterprise/OSS up to 13.2.0 Auth Proxy privileges management
A vulnerability classified as critical has been found in Grafana Enterprise and OSS up to 13.2.0. The impacted element is an unknown function of the component Auth Proxy. Performing a manipulation results in improper privilege management.
This vulnerability is cataloged as CVE-2026-14199. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected.
ghsa_unreviewed·2026-09-02
CVE-2026-14199 [HIGH] CWE-290 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected.
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
No detection rules found.
No public exploits indexed.
2026-09-02
Published