EUVD-2026-30146
GHSA-wfhv-mj62-f5xh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable Grafana API (AV:N), authenticated user required (PR:L), race-window timing raises complexity (AC:H); minted token yields high C/I but no availability impact.
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
7DescriptionNVD
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
AnalysisAI
Privilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just revoked to continue minting tokens for several seconds after the revocation event. The flaw, tagged as an authentication bypass affecting multiple supported branches of Grafana OSS (11.x, 12.x, 13.x), can yield high confidentiality and integrity impact by granting persistent API access via newly minted service-account tokens. No public exploit identified at time of analysis, EPSS is very low (0.03%), and SSVC marks exploitation as none - but the vendor has issued patches across all affected branches.
Technical ContextAI
Grafana OSS is the open-source observability platform from Grafana Labs. Service accounts are machine identities within Grafana that can be granted API tokens for programmatic access to dashboards, datasources, and admin endpoints. The vulnerability is a classic CWE-284 (Improper Access Control) race/staleness condition: the permission check that gates the 'mint service-account token' operation relies on cached or eventually-consistent authorization state, so for a brief window after a privilege revocation the user's prior entitlement is still honored. Because minted tokens carry their own lifetime independent of the user's session, the issued token outlives the revocation window and provides continued access.
RemediationAI
Vendor-released patches are available: upgrade to 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, or 13.0.1+security-01 according to your deployed branch, per https://grafana.com/security/security-advisories/cve-2026-33381. As a compensating control during the offboarding workflow, immediately revoke or rotate any service-account tokens owned by or accessible to a user whose permissions you are downgrading, rather than relying solely on the permission change - this closes the race window at the cost of operational overhead and possible disruption to automation that depended on those tokens. Where feasible, also audit Grafana audit logs for serviceaccounts/tokens creation events in the seconds following recent permission revocations to detect possible past abuse.
More in Grafana Oss
View allAuthentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions becau
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to o
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (O
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory b
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sendin
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to t
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlE
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete ar
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test e
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, re
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today