CVE-2026-14199: Grafana Auth Proxy Authentication Bypass

CVE-2026-14199 Overview

CVE-2026-14199 is an authentication bypass by spoofing vulnerability in self-managed Grafana instances that use Auth Proxy authentication with identity caching enabled. The flaw exists in how the Auth Proxy constructs its cache key, concatenating the username and forwarded identity attributes without a delimiter. This design allows distinct identities to collide on a single cache key. An authenticated attacker can shape their own identity attributes to collide with a higher-privileged user's cached entry, gaining that user's session, up to Administrator. The issue is tracked under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Authenticated users can impersonate administrators on self-managed Grafana instances running Auth Proxy with sync_ttl greater than zero.

Affected Products

Self-managed Grafana instances configured with Auth Proxy authentication
Grafana deployments with identity caching enabled (sync_ttl > 0)
Grafana Cloud is not affected

Discovery Timeline

2026-09-02 - CVE-2026-14199 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-14199

Vulnerability Analysis

Grafana supports Auth Proxy authentication, where an upstream reverse proxy authenticates users and forwards identity information through HTTP headers. To reduce load, Grafana caches resolved identities for a period defined by sync_ttl. When sync_ttl is greater than zero, the cache stores the mapping between the incoming identity signal and the resolved Grafana user.

The cache key is derived by concatenating the username with forwarded identity attributes, but no delimiter separates the fields. Two structurally different identities can therefore produce the same key. If an attacker crafts their username and attribute values so the concatenation matches a live cache entry belonging to an administrator, Grafana authenticates the attacker as the administrator.

Exploitation requires network access to the Auth Proxy path, valid low-privilege credentials, and knowledge or guessing of the target user's attributes. The high attack complexity reflects the timing dependency on a live cache entry.

Root Cause

The root cause is unsafe key construction in the Auth Proxy identity cache. Concatenating variable-length fields without a separator violates a basic requirement for injective encoding. This is a canonical instance of CWE-290, where identity comparison logic can be tricked into treating distinct principals as equivalent.

Attack Vector

The attacker authenticates to Grafana through the Auth Proxy with attributes crafted so the concatenated username plus forwarded attributes match those of a higher-privileged user whose entry is currently cached. Grafana returns the cached identity and grants the attacker the privileges bound to the collided user. See the Grafana Security Advisory CVE-2026-14199 for vendor detail.

No verified proof-of-concept code is publicly available at this time.
Refer to the Grafana Security Advisory linked above for authoritative details.

Detection Methods for CVE-2026-14199

Indicators of Compromise

Grafana audit log entries showing a user performing actions inconsistent with their assigned role, especially administrative actions from non-admin accounts.
Multiple Auth Proxy login events for different usernames from the same source IP within a short window.
Unexpected changes to organizations, data sources, users, or API keys correlated with Auth Proxy sessions.

Detection Strategies

Review Grafana access and audit logs for privilege mismatches between the authenticated username and executed operations.
Inspect Auth Proxy header sets for anomalous or malformed attribute values that could produce colliding cache keys.
Alert on rapid sequences of Auth Proxy authentications where usernames differ but combined header content overlaps.

Monitoring Recommendations

Forward Grafana server and audit logs to a centralized analytics platform for role-versus-action correlation.
Monitor the reverse proxy layer for header injection or manipulation targeting Auth Proxy attribute fields.
Track administrator-scoped API calls and configuration changes for out-of-baseline actors.

How to Mitigate CVE-2026-14199

Immediate Actions Required

Upgrade self-managed Grafana to the fixed version listed in the Grafana Security Advisory CVE-2026-14199.
If patching is not immediately possible, set sync_ttl = 0 in the [auth.proxy] configuration section to disable identity caching.
Rotate Grafana administrator credentials and API keys if compromise is suspected.

Patch Information

Grafana Labs has published a fix in the vendor advisory. Consult the Grafana Security Advisory CVE-2026-14199 for the exact fixed versions applicable to your release branch and apply the update to all self-managed instances using Auth Proxy.

Workarounds

Disable identity caching by setting sync_ttl = 0 under the [auth.proxy] section in grafana.ini.
Restrict Auth Proxy header forwarding at the reverse proxy so only expected attribute values reach Grafana.
Limit network exposure of the Grafana Auth Proxy endpoint to trusted networks until the patch is deployed.

bash

# grafana.ini - disable Auth Proxy identity caching as a temporary mitigation
[auth.proxy]
enabled = true
header_name = X-WEBAUTH-USER
header_property = username
auto_sign_up = true
sync_ttl = 0