SSO settings authorization bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Grafana (open-source and Enterprise editions) is affected when the experimental kubernetesSsoSettingsApi feature toggle is turned on, which is disabled by default. An authenticated user can exploit this flaw to read SSO client secrets and change instance-wide SSO settings without having the required permissions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Grafana Grafana Enterprise
From 13.2.0 · through 13.2.4
- Grafana Grafana OSS
From 13.2.0 · through 13.2.4