{"id":"CVE-2026-103506","published":"2026-10-28T17:17:28.797","lastModified":"2026-10-28T17:17:28.797","description":"An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-285"],"vendors":[],"products":[],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-103506","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}