CVE-2026-14199

Executive Summary

CVE-2026-14199 is an authentication bypass vulnerability affecting self-managed Grafana instances configured with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero). The flaw resides in the construction of the Auth Proxy cache key, where the username and forwarded identity attributes are concatenated without a delimiter, permitting distinct identities to hash to the same key. An authenticated attacker who can shape their own forwarded attributes to collide with the cache entry of a higher-privileged user — while that user's cache entry remains live — is subsequently authenticated as that user, with administrative privileges achievable. The vulnerability carries a CVSS score of 7.1 and is currently unpatched, with no public proof-of-concept or in-the-wild exploitation evidence at the time of writing.

Technical Analysis

Vulnerability Mechanism

Grafana's Auth Proxy authentication model relies on an upstream reverse proxy to authenticate users and forward identity information (username, roles, attributes) via HTTP headers. When identity caching is enabled (via the sync_ttl configuration option being greater than zero), Grafana caches the results of authentication and authorization lookups for the duration of the time-to-live interval to reduce upstream proxy load and improve response latency.

The vulnerability arises from the cache key generation logic. The cache key is constructed by concatenating the username with the forwarded identity attributes without any delimiter (e.g., no separator character such as : or |). This design flaw introduces a collision hazard: two semantically distinct identity tuples can produce an identical concatenated string.

Consider an example at the class level (no specific attribute names are provided in the advisory): an identity (username=admin, attribute=prod) concatenates to adminprod. An unrelated identity (username=adminp, attribute=rod) concatenates to the same string adminprod. Whether such a collision yields a cache hit depends on the downstream cache lookup semantics (hash-based lookup of the concatenated key). If the attacker's crafted identity produces a key identical to a cached higher-privileged user's key, the attacker inherits the cached authorization context.

Affected Attack Surface

• Deployment type: Self-managed (not Grafana Cloud) Grafana instances.
• Configuration prerequisites: Auth Proxy authentication must be enabled, and the sync_ttl setting (identity cache TTL) must be greater than zero.
• Preconditions for exploitation: The attacker must already have an authenticated account on the Grafana instance (per the CVSS vector, privileges required are Low). The attacker must also be able to influence the forwarding of their identity attributes (either by controlling headers at a proxy they administer or through an upstream proxy that forwards user-controlled claims).

Code-Level Insight

Insufficient technical detail is publicly available regarding the exact Rust/Go source code locations, cache module functions, or configuration keys beyond what is provided in the NVD description. The advisory mentions sync_ttl as the relevant configuration parameter, and the cache key is stated to concatenate "the username and forwarded identity attributes without a delimiter." No additional function names or file paths have been disclosed in the NVD description. Analysis at this level rests on the vulnerability class mechanics described above.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification

The attacker first identifies a target Grafana instance. Shodan queries such as product:Grafana or inspection of HTTP response headers/banners (Server: Grafana or Grafana's login page title) can reveal self-managed instances. The attacker must then determine whether the instance uses Auth Proxy authentication. This may be inferable from HTTP response characteristics (e.g., absence of a standard login form when access is mediated by an upstream proxy) or from configuration disclosures.

Additionally, the attacker must enumerate or guess the usernames and cached identity attributes of higher-privileged users. Username enumeration is plausible through login timing differences, error messages, or Grafana's user API if accessible at the Low privilege level.

Step 2 — Triggering the Flaw

The attacker, holding a low-privileged authenticated account, constructs a forwarded identity whose username-attribute concatenation collides with that of a higher-privileged target user (e.g., an Administrator). This requires the attacker to influence the forwarded attributes. In Auth Proxy setups, the upstream proxy typically maps external identity claims to headers consumed by Grafana. If the attacker can control claim values (e.g., through a self-registration flow in an upstream identity provider or by exploiting header-transformation logic at the proxy), they can shape the concatenated string.

The collision is only effective while the targeted higher-privileged user's cache entry is live, i.e., within the time window defined by sync_ttl. This adds a temporal constraint to the attack.

Step 3 — Payload / Execution Method

At the vulnerability-class level, the attack is a cache poisoning via key collision — specifically an instance of CWE-290 (Authentication Bypass by Spoofing). The attacker does not inject code, but rather crafts identity data to produce a false cache hit. The "payload" is the specially crafted set of forwarded attributes that yields the same concatenated cache key as the victim identity.

Step 4 — Post-Exploitation Impact

Once authenticated as the higher-privileged user, the attacker inherits that user's session and permissions. If the victim is an Administrator, the attacker gains full administrative control of the Grafana instance, including the ability to:

• Add or modify data source configurations (potentially exposing credentials to connected monitoring backends).
• Create or modify dashboards and alert rules.
• Manage users and roles (creating persistent backdoor accounts).
• View sensitive operational metrics and potentially extract API tokens.

The CVSS confidentiality impact is High, integrity High, and availability Low — consistent with the attack yielding read access to sensitive data and write/modify capabilities, but limited availability disruption potential.

Impact Assessment

Business Impact

Grafana is a widely deployed observability and monitoring platform used for operational telemetry aggregation, dashboarding, and alerting. A successful authentication bypass to the Administrator role exposes the organization's entire monitoring architecture to a malicious actor:

• Data exposure: Dashboards may reference business-critical application metrics, infrastructure health data, and security telemetry. High confidentiality impact per the CVSS vector.
• Integrity compromise: An attacker could tamper with dashboards to hide malicious activity, modify alert thresholds to suppress warnings, or alter data source definitions to redirect monitoring traffic to attacker-controlled endpoints.
• Credential harvesting: Grafana data source definitions often contain credentials for Prometheus, Elasticsearch, InfluxDB, cloud APIs, or other backends. Administrative access provides a path to extract these secrets and pivot deeper into the environment.

Blast Radius

The blast radius extends across all teams using the compromised Grafana instance. Given that Auth Proxy deployments are common in enterprise single-sign-on architectures, the compromised instance may serve multiple business units. The inability to distinguish a legitimately cached administrative session from an attacker-inherited one complicates audit and forensics. The attack's complexity is rated High in the CVSS vector (AC:H), reflecting the temporal window requirement (victim cache entry must be live) and the need to shape attribute concatenation.

Severity Context

• CVSS 3.1 Base Score: 7.1 (High)
• Vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
• Key discriminators: Low privilege required (some authenticated access is a precondition), High attack complexity, High confidentiality and integrity impact.

Detection Guidance

The detection rules below are intended to identify suspicious authentication patterns, anomalous cache-entry behavior, or configuration states that suggest attempted exploitation of the Auth Proxy cache key collision. Network-level detection is inherently limited because the attack manifests as legitimate-looking HTTP requests with crafted headers; therefore, the strongest signals are in application logs showing anomalous auth transitions or privilege escalations.

Sigma Rule

title: Suspicious Grafana Auth Proxy Privilege Change
id: 4f7c2a1e-9d3b-4f0a-b6c2-1a5e8d7f0c33
status: experimental
description: Detects rapid privilege escalation or identity change events in Grafana Auth Proxy sessions, potentially indicating cache key collision exploitation (CVE-2026-14199).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-14199
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    product: grafana
    service: auth
detection:
    selection_auth_change:
        EventID:
            - 'auth.user.login'
            - 'user.role.updated'
    selection_rapid_role_change:
        timestamp | span: 5s
        UserRoleBefore: 'Viewer'
        UserRoleAfter: 'Admin'
    condition: selection_auth_change and selection_rapid_role_change
falsepositives:
    - Legitimate admin granting temporary access
level: high
tags:
    - attack.t1190
    - cve.2026.14199

YARA Rule

/*
    YARA rule to detect log lines or configuration artifacts 
    consistent with Grafana Auth Proxy identity cache misconfiguration 
    associated with CVE-2026-14199.
*/
rule Grafana_AuthProxy_CacheKey_Collision_CVE_2026_14199
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Grafana log/config artifacts referencing auth proxy without delimiter or anomalous role elevation"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14199"
        cve = "CVE-2026-14199"
        score = 60
    strings:
        $auth_proxy = "auth.proxy" ascii nocase
        $sync_ttl = "sync_ttl" ascii nocase
        $role_elevation = "role.updated" ascii nocase
        $privilege_escalation = "privilege escalation" ascii nocase
        $cache_hit = "auth.cache.hit" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D  // CRLF (log files)
        and 2 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Grafana Auth Proxy Cache Key Collision Attempt (CVE-2026-14199)";
    flow:established,to_server;
    content:"/api/user"; http.uri;
    content:"X-WEBAUTH-USER"; http.header;
    pcre:"/^X-WEBAUTH-(USER|NAME|ROLE|EMAIL):[^\r\n]{1,200}/mi";
    reference:cve,2026-14199;
    classtype:attempted-admin;
    sid:202614199;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15;
)

Note: This rule flags HTTP traffic containing Auth Proxy authentication headers (X-WEBAUTH-* style) combined with access to user-management API endpoints. Due to lack of public exploit specifics, the pattern is intentionally broad; synthetic tuning against legitimate proxy-forwarded traffic is strongly advised.

Elastic Detection

// Detect rapid, anomalous role changes in Grafana auth logs
sequence by user.name with maxspan=10s
    [ authentication where event.outcome == "success" and
      process.name == "grafana-server" and
      user.roles == "Viewer" and event.action == "login" ]
    [ audit where event.action == "role_change" and
      user.roles == "Admin" ]

Splunk SPL Query

index=grafana sourcetype=grafana_log*
| eval isSuspicious = if(match(_raw, "auth.proxy.*cache") OR match(_raw, "sync_ttl"), 1, 0)
| search isSuspicious=1
| rex field=_raw "user_role_before=(?<role_before>\w+)" 
| rex field=_raw "user_role_after=(?<role_after>\w+)"
| where role_before="Viewer" AND role_after="Admin" AND timestamp >= relative_time(now(), "-5s")
| stats count by user_id, src_ip, _time
| sort - _time

Wazuh OSSEC Rule

<group name="grafana,">
    <rule id="100311" level="12">
        <decoded_as>json</decoded_as>
        <field name="event_type">^auth\.user</field>
        <field name="role_before">^Viewer$</field>
        <field name="role_after">^Admin$</field>
        <description>Grafana: Rapid privilege escalation from Viewer to Admin - potential Auth Proxy cache collision (CVE-2026-14199)</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>authentication_bypass,grafana</group>
    </rule>

    <rule id="100312" level="6">
        <if_sid>100311</if_sid>
        <field name="action">^blocked</field>
        <description>Grafana: Privilege escalation attempt blocked</description>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source at the time of this report. No vendor advisory beyond the NVD entry has been published, and no fixed version has been announced.

1) Immediate Mitigations

• Disable identity caching: Set sync_ttl to 0 (zero) on self-managed Grafana instances using Auth Proxy authentication. This eliminates the cache-collision attack surface entirely, at the cost of increased upstream proxy load.
• Restrict attribute control: If disabling caching is not operationally feasible, audit the upstream proxy configuration to ensure that forwarded identity attributes (headers consumed by Grafana's Auth Proxy) originate from a trusted source and cannot be influenced by user-supplied claims. Implement strict allow-lists on accepted header names and values.
• Reduce exposure: Place the Grafana instance and its upstream proxy behind network access controls, restrict access to trusted IP ranges, and require MFA at the upstream identity provider layer.
• Monitor aggressively: Apply the detection rules above; pay particular attention to rapid role changes and anomalous auth events. Alert on any Viewer-to-Admin transitions occurring within the configured sync_ttl window.

2) Patch / Upgrade Steps

• No vendor fix is currently available. Monitor Grafana's official security advisory page and release notes for a patched version, and apply immediately upon publication.
• Until a patch is released, treat every Auth Proxy-enabled instance with caching active as high-risk and prioritize it for the mitigations above.

3) Long-Term Hardening

• Architectural review: Re-evaluate whether Auth Proxy authentication is the most appropriate mechanism for each deployment. Consider alternative SSO integration methods (OAuth2, SAML, LDAP) whose session and cache semantics do not rely on concatenated identity strings.
• Cache key design: If/when a vendor fix is released, verify that the implementation uses a delimited or structured cache key (e.g., JSON serialization, length-prefixed fields) that is cryptographically collision-resistant for distinct identity tuples. This should be validated in testing before production deployment.
• Defense in depth: Implement strict separation between authentication layers (upstream proxy) and authorization decisions (Grafana), ensuring that role assignments are re-validated against the authoritative identity provider on each request, not only retrieved from cache.
• Logging and audit: Enable detailed audit logging of role changes and session provenance. Retain logs for a period sufficient to support forensic analysis (e.g., 90–180 days).

References

1. NVD Entry for CVE-2026-14199 — https://nvd.nist.gov/vuln/detail/CVE-2026-14199 (Authoritative vulnerability description and CVSS vector).
2. CWE-290: Authentication Bypass by Spoofing — https://cwe.mitre.org/data/definitions/290.html (Weakness taxonomy reference).
3. Grafana Security Advisories Portal — https://grafana.com/security/ (Monitor for future vendor advisories and patch announcements; no advisory for CVE-2026-14199 published as of this report).
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/ (Tactical exploitation classification).
5. FIRST.org EPSS / CISA KEV — EPSS not yet scored; CISA KEV listing: NO (no known exploited vulnerability status). No threat actor campaigns or exploit-in-the-wild evidence has been reported for this CVE at the time of writing.