CVE-2026-14199
Session takeover via Auth Proxy cache key collision
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
| CWE | CWE-290 CWE-1023 CWE-863 |
| Vendor | grafana |
| Product | grafana enterprise |
| Ecosystems | |
| Industries | Technology |
| Published | Sep 2, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for grafana grafana enterprise
Be the first to know when new high vulnerabilities affecting grafana grafana enterprise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Grafana / Grafana Enterprise
11.0.0 ≤ 11.6.17 12.0.0 ≤ 12.2.11 12.3.0 ≤ 12.3.11 12.4.0 ≤ 12.4.9 13.0.0 ≤ 13.0.7 13.1.0 ≤ 13.1.4 13.2.0 ≤ 13.2.0
Grafana / Grafana OSS
11.0.0 ≤ 11.6.17 12.0.0 ≤ 12.2.11 12.3.0 ≤ 12.3.11 12.4.0 ≤ 12.4.9 13.0.0 ≤ 13.0.7 13.1.0 ≤ 13.1.4 13.2.0 ≤ 13.2.0
References
Credits
rebelarch (Researcher)