This vulnerability in Grafana OSS's Auth Proxy feature arises from the default IPv6 allow-list mask being set to /32 instead of a more restrictive mask such as /128. This can cause unintended broader access than intended when relying on IPv6 allow-lists. The problem does not affect addresses where a mask is explicitly provided, nor does it affect other authentication mechanisms like Okta, SAML, or LDAP. The CVSS 3.1 score is 7.4, indicating a high severity with network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required.

The vulnerability can lead to unauthorized access through the Auth Proxy feature if IPv6 allow-lists are used without specifying a proper mask, potentially exposing sensitive data or allowing unauthorized actions. Since the default mask is /32, this is broader than the typical /128 mask for IPv6 addresses, increasing the attack surface. Other authentication methods remain unaffected, limiting the scope to Auth Proxy only.

There is no official patch or fix currently confirmed for this vulnerability. To mitigate the issue, users should explicitly specify the desired IPv6 mask (usually /128) in the allow-list addresses for the Auth Proxy feature. This adjustment restricts access appropriately and prevents the broader default mask from causing unintended access. Monitor vendor advisories for any official fixes or updates.