Answer in brief
CVE-2026-14199 records a High severity (CVSS 7.1) vulnerability in Session takeover via Auth Proxy cache key collision. The current sources do not mark it as known exploited. The current feed maps Grafana/Grafana Enterprise (generic), Grafana/Grafana Enterprise (generic), Grafana/Grafana OSS (generic), Grafana/Grafana OSS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Grafana/Grafana Enterprise (generic), Grafana/Grafana Enterprise (generic), Grafana/Grafana OSS (generic), Grafana/Grafana OSS (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Grafana/Grafana Enterprisegeneric | >=11.0.0 <=11.6.17 || >=12.0.0 <=12.2.11 || >=12.3.0 <=12.3.11 || >=12.4.0 <=12.4.9 || >=13.0.0 <=13.0.7 || >=13.1.0 <=13.1.4 || >=13.2.0 <=13.2.0 | Not reported |
| Grafana/Grafana Enterprisegeneric | 11.0.0 || 12.0.0 || 12.3.0 || 12.4.0 || 13.0.0 || 13.1.0 || 13.2.0 | Not reported |
| Grafana/Grafana OSSgeneric | >=11.0.0 <=11.6.17 || >=12.0.0 <=12.2.11 || >=12.3.0 <=12.3.11 || >=12.4.0 <=12.4.9 || >=13.0.0 <=13.0.7 || >=13.1.0 <=13.1.4 || >=13.2.0 <=13.2.0 | Not reported |
| Grafana/Grafana OSSgeneric | 11.0.0 || 12.0.0 || 12.3.0 || 12.4.0 || 13.0.0 || 13.1.0 || 13.2.0 | Not reported |
Published upstream
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 2, 2026
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
Quoted source text, attributed separately from HOL analysis.