Grafana fixes SSO secret exposure and Azure token leak flaws

Grafana fixes SSO secret exposure and Azure token leak flaws

28 October 2026: Grafana Labs has fixed three high-severity flaws in Grafana OSS and Enterprise. The worst, CVE-2026-103506 (CVSS 8.9), lets any logged-in user read the instance's single sign-on client secrets and change its SSO settings, but only on Grafana 13.2 with an experimental feature flag switched on. The other two, both scored 7.7, can leak an Azure access token and let alert editors redirect notifications. Grafana's advisory gives 13.2.5 as the fix for the SSO flaw.

Not yet independently verified. Not yet independently verified. Grafana's advisory pages refused our reader, so the descriptions and scores here come from the NVD records Grafana Labs supplied; the fixed version for the two 7.7 flaws on each release line is not stated in what we could read. We will update this when it can be confirmed, and remove this note.

The SSO settings flaw

CVE-2026-103506 is a missing authorisation check. With the experimental kubernetesSsoSettingsApi toggle enabled, any authenticated user can read the client secrets of the configured SSO providers and modify instance-wide SSO settings without the admin permission that should be required. The flag is off by default, so most installations are not exposed. Where it was turned on, an attacker who could rewrite the SSO settings could point logins at an identity provider they control.

Anyone who enabled the flag should upgrade to 13.2.5 or later and rotate the SSO client secrets, since there is no way to tell from the outside whether they were read.

Two flaws at 7.7

• Azure Monitor token leak (CVE-2026-88967): a user with query access to an Azure Monitor data source can make Grafana send requests to an endpoint the attacker controls, and the request carries the data source's Azure access token. This is a server-side request forgery, and the stolen token carries whatever Azure rights the data source's identity holds.
• Contact point bypass (CVE-2026-100105): a user allowed to edit contact points, but not their protected fields, can change those fields anyway, such as a webhook's destination URL, by switching an integration to a legacy schema version. That can expose stored credentials and send alert notifications somewhere else.

Italy's national cybersecurity agency counts five flaws in the release, three of them high, and gives the affected range as every version from 10.0.0 up to 12.4.14, plus 13.0, 13.1 and 13.2 releases before 13.0.12, 13.1.9 and 13.2.5. Those four releases are the upgrade targets.

Checking an installation

Three questions settle exposure: is kubernetesSsoSettingsApi enabled (it is listed in the feature toggles section of the configuration), does the instance use Azure Monitor data sources with users who can query but should not hold the token, and who has edit rights on alerting contact points. Grafana Cloud is updated by Grafana Labs. Our data visualization software category lists five products.

Company profile on TrustList: Grafana Labs

Related on TrustList:

• Citrix fixes CVSS 9.5 NetScaler SAML flaw; no attacks seen so far
• NetScaler SAML zero-day CVE-2026-88779: check Gateway and AAA SAML configurations and upgrade to 14.1-73.41 or 13.1-64.28
• Siemens fixes a SAML replay flaw in the Mendix single sign-on module

Sources

• Grafana Labs security advisory CVE-2026-103506, 27 October 2026
• NVD: CVE-2026-103506, CVE-2026-88967, CVE-2026-100105, 28 October 2026
• ACN CSIRT Italia AL04/261029: Risolte vulnerabilità in Grafana, 29 October 2026