Description

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T16:17:14.517Z",
  "pubdate": "2026-09-02T16:17:14.517Z",
  "executiveSummary": "This vulnerability is an authentication bypass via identity spoofing affecting self-managed Grafana instances. The flaw resides in the Auth Proxy authentication mechanism when identity caching is enabled.\nBy manipulating forwarded identity attributes, an attacker can trigger a cache collision, resulting in the impersonation of arbitrary users, including those with Administrator privileges.\nThe vulnerability exists because the Auth Proxy cache key concatenation process lacks a delimiter between the username and identity attributes, allowing for collisions where distinct user identities resolve to the same cache entry.\nThe risk is severe as it allows unauthorized access to administrative functions. Exploitation requires the attacker to have the ability to influence forwarded identity attributes in an environment where sync_ttl is set to a value greater than zero.\nSuccessful exploitation allows an unprivileged user to gain the session context of a higher-privileged user, enabling unauthorized access to the Grafana instance with the privileges of the victim.",
  "technicalDetails": "The root cause of this vulnerability is improper cache key generation within the Grafana Auth Proxy implementation. When identity caching is enabled via the sync_ttl configuration setting, Grafana stores user authentication information to improve performance.\nThe mechanism used to generate the cache key involves simple concatenation of the username and various forwarded identity attributes. Crucially, this implementation fails to include a unique delimiter between these concatenated fields. Consequently, the combination of 'Username=A' and 'Attribute=BC' results in the same cache key as 'Username=AB' and 'Attribute=C'.\nAn attacker can exploit this ambiguity by carefully crafting their own identity attributes. By controlling these forwarded headers, an attacker can force their session to collide with an existing cache entry of a targeted user.\nThe attack flow follows these steps: 1) The attacker identifies a target user with higher privileges. 2) The attacker shapes their forwarded identity attributes so that the concatenated string matches the targeted user's string. 3) The attacker triggers an authentication request through the Auth Proxy. 4) The Auth Proxy checks the cache, finds the collided key belonging to the target, and incorrectly associates the attacker's session with the target's identity. 5) Grafana grants the attacker the permissions associated with the victim's profile.\nThis vulnerability is limited to self-managed instances where Auth Proxy is active and identity caching is enabled (sync_ttl > 0). The authentication requirement is low, as the attacker only needs to be able to influence the identity attributes that the proxy forwards to Grafana. Post-exploitation impact includes full system compromise if an Administrator account is spoofed."
}