CVE-2026-14199: grafana

csirt@kutim:~/threat-intel/cve/CVE-2026-14199

CVSS 8.1 · High EPSS 0,31%

Kerentanan Authentication Bypass by Spoofing pada grafana. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

Rincian

Terbit di NVD: 2 September 2026
Terakhir diubah: 15 September 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-290: Authentication Bypass by Spoofing
CWE-863: Incorrect Authorization
CWE-1023: Incomplete Comparison with Missing Factors
EPSS (30 hari): 0,31% peluang dieksploitasi; lebih tinggi dari 22,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
grafana	grafana	Semua versi sebelum 11.0.0
grafana	grafana	Versi 12.4.10 hingga sebelum 13.0.0
grafana	grafana	Versi 13.0.8 hingga sebelum 13.1.0
grafana	grafana	Versi 13.1.5 hingga sebelum 13.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://grafana.com/security/security-advisories/cve-2026-14199 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.