CVE-2026-14199 Session takeover via Auth Proxy cache key collision
Authenticated users can hijack sessions of higher-privileged users via cache key collisions in Grafana's Auth Proxy when identity caching is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14199?
CVE-2026-14199 is a high-severity authentication bypass vulnerability in Grafana Grafana, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
Which versions are affected by CVE-2026-14199?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 11.0.0 | 12.4.10, 13.0.8, 13.2.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-14199?
Upgrade grafana to a fixed version for your release line: 12.4.10, 13.0.8 or 13.2.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-14199 being exploited?
There is no known exploitation of CVE-2026-14199 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-14199, CLSA-2026-1790248981, GHSA-9758-8g25-vw94, MINI-2p2f-jw88-224x, MINI-2p2r-6xq2-3hh2, MINI-3vhf-937g-vfpj and 17 more.