Description
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Grafana Grafana OSS
Default version status: unaffected
9.4.0 to ≤ 11.6.14affected11.6.14 to < 11.6.14+security-04affected12.0.0 to ≤ 12.2.8affected12.2.8 to < 12.2.8+security-04affected12.3.0 to ≤ 12.3.6affected12.3.6 to < 12.3.6+security-04affected12.4.0 to ≤ 12.4.3affected12.4.3 to < 12.4.3+security-02affected13.0.0 to ≤ 13.0.1affected13.0.1 to < 13.0.1+security-01affected