Grafana Enterprise: SCIM provisioning lets a numeric externalId override internal user IDs

Impact

On Grafana 12.x instances where SCIM user provisioning is enabled, a malicious or compromised SCIM client can create a user whose externalId is numeric, which collides with Grafana's internal user IDs. The result is that the provisioned account can be mapped onto an existing internal user, giving impersonation and privilege escalation up to administrative access. For a GPU fleet this is the fleet's eyes: Grafana is usually the shared dashboard over DCGM, node exporters, job schedulers and tenant utilization, often wired to datasources holding cluster credentials. An attacker who becomes a Grafana admin can read every tenant's telemetry, pivot through saved datasource credentials, and silence the alerting that would show a node or fabric going bad. Exposure requires both the enableSCIM feature flag and user_sync_enabled in the [auth.scim] block to be on, so instances using plain OAuth or LDAP sync are not affected.

Who can reach it

Network reachable to the Grafana SCIM endpoint, as a SCIM client - that is, whoever holds the identity-provider credentials Grafana trusts for provisioning, or anyone who has compromised that IdP integration. No Grafana user account is needed; the trust comes from the SCIM client itself.

What to do

Upgrade Grafana Enterprise to the fixed 12.x release named in Grafana's advisory; the vendor advisory is the authoritative source for the exact patch versions. As an immediate mitigation that does not require the upgrade, turn off the enableSCIM feature flag or set user_sync_enabled = false in [auth.scim] and fall back to your previous user-sync method. Rollout cost is low for the fleet: this is a control-plane service restart, not a node action - no GPU node needs draining or rebooting, though dashboards and alerting are briefly unavailable while Grafana restarts. After patching, audit provisioned users for numeric externalId values and for unexpected admin grants, since a successful attack leaves a legitimate-looking account behind.

References

Related entries

• Vertiv (stack-based buffer overflow, code execution): A stack overflow gives an attacker code execution on the VertivCVE-2025-41426 · Vertiv (stack-based buffer overflow, code execution)Critical
• Vertiv Liebert RDU101 (<=1.9.0.0) and Liebert IS-UNITY (<=8.4.1.0) communication cards: Authentication bypass plusCVE-2025-46412 · Vertiv Liebert RDU101 (<=1.9.0.0) and Liebert IS-UNITY (<=8.4.1.0) communication cardsCritical
• Teleport: Remote authentication bypass in Teleport Community Edition (<=17.5.1)CVE-2025-49825 · TeleportCritical
• F5 BIG-IP (APM access policy): Specific malicious traffic against a virtual server with a BIG-IP APM access policyCVE-2025-53521 · F5 BIG-IP (APM access policy)Critical
• Citrix NetScaler ADC / Gateway (configured as VPN Gateway, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server): A memoryCVE-2025-6543 · Citrix NetScaler ADC / Gateway (configured as VPN Gateway, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server)Critical
• Lantronix EDS5000 serial-to-Ethernet device server: Root command execution on the device serverCVE-2025-67038 · Lantronix EDS5000 serial-to-Ethernet device serverCritical