CVE-2026-14199

CVE-2026-14199 is an authentication bypass (spoofing) in the Auth Proxy authentication module of self-managed Grafana, caused by cache keys that concatenate the username and forwarded identity attributes without a delimiter, allowing distinct identities to collide onto a single cached entry. To exploit it, an authenticated low-privileged user must craft their own forwarded identity attributes so they collide with a higher-privileged user's cache key while that entry is still live, i.e., within the configured sync_ttl window. A successful attacker is then authenticated as the victim user, potentially gaining full Administrator access, with high confidentiality and integrity impact. Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled are affected; instances without Auth Proxy, instances with sync_ttl set to 0, and Grafana Cloud are not affected. No public proof-of-concept, KEV listing, or in-the-wild exploitation is currently reported, and EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: Operators of self-managed Grafana instances using Auth Proxy should upgrade to the patched release referenced in the Grafana security advisory as soon as available, and first confirm exposure by checking whether auth proxy authentication is enabled and sync_ttl is greater than 0. As an interim mitigation, set sync_ttl to 0 to disable identity caching, which eliminates the collision path. Review authentication logs for signs that one account was authenticated under another user's identity, particularly privileged or administrative sessions.