Grafana: four authenticated flaws (CVE-2026-103506, CVE-2026-100105) fixed in 12.4.14, 13.0.12, 13.1.9, 13.2.5
CVE-2026-100105 CVE-2026-103506 CVE-2026-88858 CVE-2026-88967
Published 01/11/2026 02:19
Timeline
2 events over 8 d
- 23/10/2026 12:20ConfirmedBSI CERT-Bund (WID)+8 d
- 01/11/2026 02:19Published on WatchtowerPro CISO
In short
Grafana has fixed four flaws that each need a login: two authorization bypasses, a denial of service and a token disclosure. BSI CERT-Bund has warned about them. Update to 12.4.14, 13.0.12, 13.1.9 or 13.2.5.
How bad is it
High. A logged-in Grafana user can, depending on the flaw, steal stored credentials or SSO secrets, redirect alert notifications, or crash the server.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 4 CVEs · CVSS 4.0 from NVD, from grafana.com, read 01/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Slow it down or interrupt it
Type: server-side request forgery.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- CVE-2026-100105 (alerting contact point authorization bypass): Grafana from 12.4.0 up to the fixed versions.
- CVE-2026-88858 (expression parser denial of service): Grafana from 7.4.0 up to the fixed versions.
- CVE-2026-88967 (Azure Monitor token disclosure via SSRF): Grafana from 10.0.0 up to the fixed versions.
- CVE-2026-103506 (SSO settings authorization bypass): Grafana 13.2 before 13.2.5, only when the experimental kubernetesSsoSettingsApi feature toggle is on (off by default).
Fixed in
- 12.4 branch: 12.4.14
- 13.0 branch: 13.0.12
- 13.1 branch: 13.1.9
- 13.2 branch: 13.2.5
What to do now
- Update Grafana to the fixed version for your branch: 12.4.14, 13.0.12, 13.1.9 or 13.2.5 (or later).
- On 13.2, make sure the kubernetesSsoSettingsApi feature toggle is disabled. Interim measures reduce exposure and do not make a server safe; only the update does.
- Rotate stored contact point credentials, SSO client secrets and Azure data source credentials after patching if they may have been exposed.
- Do not run the public proof-of-concept code against production systems.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 9 sources with their dates. And technology matching: which of your systems run Grafana, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [mittel] Grafana: Schwachstelle ermöglicht Privilegieneskalation CERT · [UPDATE] [mittel] Grafana: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Offenlegung von Informationen CERT · [UPDATE] [hoch] Grafana: Schwachstelle ermöglicht Codeausführung CERT