CVE-2026-103506

A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On (SSO) settings Application Programming Interface (API) feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this vulnerability to view sensitive SSO client secrets and modify authentication settings.

This vulnerability is rated as an Important impact because authenticated users possessing minimal viewer privileges can expose sensitive single sign-on credentials and modify authentication configurations across the platform. Such credential exposure may allow attackers to compromise downstream identity providers or escalate access within the organization. However, the risk is constrained in standard Red Hat environments because the affected API relies on an experimental feature toggle that remains deactivated by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure the experimental kubernetesSsoSettingsApi feature toggle is disabled. By default, this feature toggle is inactive. If this feature was manually activated, remove kubernetesSsoSettingsApi from the [feature_toggles] section in the Grafana configuration file (grafana.ini) or from the GF_FEATURE_TOGGLES_ENABLE environment variable.

Apply the configuration by restarting the service:

systemctl restart grafana-server

Warning: Restarting the grafana-server service will result in a temporary interruption of service for connected users. Additionally, if the toggle was previously enabled, immediately rotate all associated SSO client secrets to prevent unauthorized access from potentially exposed credentials.