CVE-2026-14199
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in Grafana (only self-managed instances with Auth Proxy authentication and identity caching enabled) where the Auth Proxy cache key concatenates username and forwarded identity attributes without a delimiter, allowing distinct identities to collide. An authenticated user can spoof a higher-privileged user.
Risk Assessment
An attacker can authenticate as a higher-privileged user, up to Administrator, leading to unauthorized access and potential takeover of the Grafana instance.
Recommendation
Update Grafana to a patched version. Disable identity caching or set sync_ttl to zero if possible.
Other vulnerabilities in Grafana
See all- CVE-2026-28381Critical
The Snowflake datasource vulnerability allows GET/PUT commands, enabling any user with query access to read/write files between the local Grafana server and the connected Snowflake host.
- CVE-2026-27876Critical
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to remote arbitrary code execution (RCE). The vulnerability requires the sqlExpressions feature toggle to be enabled and affects specific Grafana OSS versions.
- CVE-2025-41115Critical
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which could allow overriding internal user IDs and lead to impersonation or privilege escalation.
- CVE-2023-3128Critical
Grafana validates Azure AD accounts based on the email claim. The email field in Azure AD profiles is not unique and can be easily modified, leading to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- CVE-2026-19475Medium
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
- CVE-2026-19197Medium
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
- CVE-2026-17033Medium
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
- CVE-2026-17183High
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
- CVE-2026-11817Medium
This vulnerability only affects Grafana stacks with multiple organizations. A user who is an Org Admin of one organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data from other organizations. Disclosed data is limited to dashboard/folder UIDs and permission mappings, not content or personal data.
- CVE-2026-21723Medium
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) in Grafana can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
Original NVD description (English source)
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).