Grafana Auth Proxy IPv6 Allow-List Vulnerability

A vulnerability exists in Grafana's Auth Proxy feature when using an IPv6 allow-list, as it defaults to /32 addresses. This issue allows for potential misconfigurations, since only the Auth Proxy is affected; other authentication methods like Okta, SAML, and LDAP are not impacted. To address this vulnerability, users should specify the desired mask, typically /128, for the addresses in the allow-list.

Impact

Exploitation of this vulnerability could lead to improper authentication proxying, potentially allowing unauthorized access or actions within the application.

Remediation

Users can easily mitigate this vulnerability by adding the appropriate mask, usually /128, to the IPv6 addresses in the allow-list for the Auth Proxy feature.