Grafana OSS CVE-2026-33381

Requires an authenticated Grafana OSS user (PR:L) who currently holds - or held within the last few seconds - permission to mint tokens for a target service account, and who issues the mint request during the brief staleness window immediately following revocation. Exploitation is limited to Grafana OSS deployments on the affected 11.6.x/12.x/13.0.x builds, requires precise timing tied to the revocation event (no user interaction by the victim, but the attacker must act within seconds), and is meaningful only where service-account tokens grant access the revoked user is not otherwise entitled to.

Signals are split. CVSS 3.1 of 8.1 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) reflects that an already-authenticated low-privileged Grafana user can, with low complexity, escalate to persistent high-impact API access via a minted service-account token. However, EPSS is only 0.03% (8th percentile), CISA SSVC marks Exploitation as 'none' and Automatable as 'no', and there is no KEV listing and no public POC - consistent with a logic flaw that requires precise timing and an attacker who already had the revoked permission. Realistic priority is moderate rather than urgent: it matters most for tenants that routinely rotate operator access (offboarding, role downgrades) and rely on Grafana service accounts as a privilege boundary. Note the apparent inconsistency in EUVD version ranges (several entries list overlapping or inverted bounds such as 'Grafana OSS 9.2.0 ≤11.6.14') - operators should cross-check the Grafana advisory directly for the exact fixed build for their branch.

A Grafana editor or org admin who anticipates being demoted or offboarded scripts a tight loop that calls the service-account token-mint API. When an administrator revokes their permission, the attacker's loop continues to succeed for a few seconds, producing one or more long-lived API tokens that they then use from any network location to read dashboards, query datasources, or call admin endpoints long after their interactive access is gone. No public exploit identified at time of analysis, but the technique is straightforward to script.