CVE-2026-14199: CWE-290 in Grafana Grafana Enterprise

This vulnerability in Grafana Enterprise occurs when Auth Proxy authentication is combined with identity caching enabled via sync_ttl greater than zero. The cache key used for authentication concatenates the username and forwarded identity attributes without any delimiter, causing different identities to potentially share the same cache key. An attacker who controls their own attributes can craft them to collide with those of a higher-privileged user currently cached, thereby bypassing authentication and gaining unauthorized access with that user's privileges, up to Administrator level. This is an authentication bypass vulnerability classified under CWE-290 (Authentication Bypass), CWE-1023 (Improper Restriction of Communication Channel to Intended Endpoints), and CWE-863 (Incorrect Authorization).

Successful exploitation allows an authenticated user to impersonate another user with higher privileges, including administrators, resulting in a complete authentication bypass. This can lead to unauthorized access and potential compromise of the Grafana instance's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling identity caching (setting sync_ttl to zero) or avoid using Auth Proxy authentication with identity caching enabled. Monitor vendor communications for official patches or temporary mitigations.