CVE-2026-14199: Session takeover via Auth Proxy cache key collision

Vulnerability summary

CVE-2026-14199 is a high (CVSS 8.1) Authentication Bypass by Spoofing vulnerability in grafana. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.6% of scored vulnerabilities.

Timeline

1. 02-09-2026
   PublishedVulnerability first disclosed.
2. 03-09-2026
   Last modifiedVulnerability information updated.

Description

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-1023Incomplete Comparison with Missing FactorsThe product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.