CVE-2026-14199 is a high severity authentication bypass (CVSS 7.1) in self-managed Grafana. It applies only where Auth Proxy authentication is used with identity caching enabled, meaning sync_ttl above zero. Distinct identities could collide on one cache key, up to Administrator.
What's affected
- Self-managed Grafana with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero). The Grafana advisory describes affected instances as Grafana Enterprise.
- Fixed versions listed on the advisory: 12.4.10 for the 12.4 line, 13.0.8 for 13.0, 13.1.5 for 13.1, and 13.2.1 and later. The advisory also lists a "below 11.0.0" entry, so read it directly to confirm how your version is treated.
- Workaround: none stated. Since the flaw needs sync_ttl above zero, turning identity caching off would remove the precondition, but that is my inference, not Grafana's guidance.
Severity: the record and Grafana agree on 7.1 High (vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L). One minor difference: the record says self-managed Grafana while the advisory names Enterprise. Check which applies to you.
How to check if you're exposed
Look in grafana.ini, or the equivalent environment variables, for the Auth Proxy block.
grep -A6 'auth.proxy' /etc/grafana/grafana.ini
If the section is enabled and sync_ttl is set above zero, you are in the affected configuration. Then check the version:
grafana-server --version
If Auth Proxy is not enabled, this CVE does not apply to your instance.
What to do now
- Check whether Auth Proxy is enabled and what sync_ttl is set to.
- Upgrade to a fixed version for your line: 12.4.10, 13.0.8, 13.1.5 or 13.2.1 and later.
- Until you can upgrade, consider whether identity caching is needed, and confirm any change with Grafana's guidance.
- Review which Grafana users hold Administrator, and look for unexpected admin sessions.
Why it matters
The record lists CWE-1023 (Incomplete Comparison with Missing Factors), CWE-290 (Authentication Bypass by Spoofing) and CWE-863 (Incorrect Authorization). The Auth Proxy cache key joined the username and the forwarded identity attributes without a delimiter. Two different identities could therefore produce the same key. A user who shapes their own attributes to collide with a more privileged user, while that user's cache entry is live, is treated as that user.
Cache keys are security decisions. When a key is built by concatenation without a separator, ambiguity creeps in. The high complexity rating reflects that the attacker needs a live entry for a victim. The record does not list the CVE as exploited, and it is not in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected without Auth Proxy?
The advisory says only instances with Auth Proxy authentication and identity caching are affected.
What does sync_ttl do?
It controls how long the proxy identity is cached. The advisory says values above zero are required for the issue.
Sources
Last reviewed: 18 October 2026.
