CVE-2026-21725

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21725", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-01-05T09:26:06.214Z", "datePublished": "2026-02-25T12:35:43.104Z", "dateUpdated": "2026-08-27T17:22:30.280Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:30.280Z"}, "datePublic": "2026-02-25T08:21:23.844Z", "title": "Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name", "descriptions": [{"lang": "en", "value": "A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.\n\nThis requires several very stringent conditions to be met:\n\n- The attacker must have admin access to the specific datasource prior to its first deletion.\n- Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.\n- The attacker must delete the datasource, then someone must recreate it.\n- The new datasource must not have the attacker as an admin.\n- The new datasource must have the same UID as the prior datasource. These are randomised by default.\n- The datasource can now be re-deleted by the attacker.\n- Once 30 seconds are up, the attack is spent and cannot be repeated.\n- No datasource with any other UID can be attacked."}], "affected": [{"vendor": "Grafana", "product": "Grafana", "defaultStatus": "unaffected", "versions": [{"version": "v11.0.0", "status": "affected", "versionType": "semver", "lessThan": "v12.4.1"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21725", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"}}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-367", "lang": "en", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:13:32.666615Z", "id": "CVE-2026-21725", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-10T13:25:12.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T15:13:32.666615Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:13:44.864Z"}}], "cna": {"title": "Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name", "source": {"discovery": "BUG_BOUNTY"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"}}], "affected": [{"vendor": "Grafana", "product": "Grafana", "versions": [{"status": "affected", "version": "v11.0.0", "lessThan": "v12.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-25T08:21:23.844Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21725", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.\n\nThis requires several very stringent conditions to be met:\n\n- The attacker must have admin access to the specific datasource prior to its first deletion.\n- Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.\n- The attacker must delete the datasource, then someone must recreate it.\n- The new datasource must not have the attacker as an admin.\n- The new datasource must have the same UID as the prior datasource. These are randomised by default.\n- The datasource can now be re-deleted by the attacker.\n- Once 30 seconds are up, the attack is spent and cannot be repeated.\n- No datasource with any other UID can be attacked."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:30.280Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21725", "state": "PUBLISHED", "dateUpdated": "2026-08-27T17:22:30.280Z", "dateReserved": "2026-01-05T09:26:06.214Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-02-25T12:35:43.104Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana", "vendor": "Grafana", "versions": [{"lessThan": "v12.4.1", "status": "affected", "version": "v11.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:-:*:*:enterprise:*:*:*", "matchCriteriaId": "0B8EFF4D-5611-41A6-B555-4A7911C72824", "versionEndExcluding": "12.4.1", "versionStartIncluding": "11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.\n\nThis requires several very stringent conditions to be met:\n\n- The attacker must have admin access to the specific datasource prior to its first deletion.\n- Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.\n- The attacker must delete the datasource, then someone must recreate it.\n- The new datasource must not have the attacker as an admin.\n- The new datasource must have the same UID as the prior datasource. These are randomised by default.\n- The datasource can now be re-deleted by the attacker.\n- Once 30 seconds are up, the attack is spent and cannot be repeated.\n- No datasource with any other UID can be attacked."}, {"lang": "es", "value": "Una vulnerabilidad de tipo \"time-of-create-to-time-of-use\" (TOCTOU) permite que las fuentes de datos recientemente eliminadas y luego recreadas sean re-eliminadas sin permiso para hacerlo.\n\nEsto requiere que se cumplan varias condiciones muy estrictas:\n\n- El atacante debe tener acceso de administrador a la fuente de datos espec\u00edfica antes de su primera eliminaci\u00f3n.\n- Tras la eliminaci\u00f3n, todos los pasos del ataque deben ocurrir dentro de los siguientes 30 segundos y en el mismo pod de Grafana.\n- El atacante debe eliminar la fuente de datos, luego alguien debe recrearla.\n- La nueva fuente de datos no debe tener al atacante como administrador.\n- La nueva fuente de datos debe tener el mismo UID que la fuente de datos anterior. Estos se aleatorizan por defecto.\n- La fuente de datos ahora puede ser re-eliminada por el atacante.\n- Una vez transcurridos 30 segundos, el ataque se agota y no puede repetirse.\n- Ninguna fuente de datos con cualquier otro UID puede ser atacada."}], "id": "CVE-2026-21725", "lastModified": "2026-06-17T13:20:05.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21725", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:13:32.666615Z", "version": "2.0.3"}}]}, "published": "2026-02-25T13:16:05.240", "references": [{"source": "security@grafana.com", "tags": ["Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-21725"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-367"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Unauthorized data source deletion via time-of-create-to-time-of-use (TOCTOU) vulnerability", "id": "2442609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442609"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in Grafana. This vulnerability, known as a time-of-create-to-time-of-use (TOCTOU) issue, allows an attacker to delete a data source without proper authorization. For this to occur, the attacker must have previously managed the data source, and it must be recreated with the same unique identifier (UID) within a 30-second window on the same Grafana server. The consequence is the unauthorized deletion of a data source, which can lead to a denial of service for that specific resource."], "name": "CVE-2026-21725", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-25T12:35:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21725\nhttps://grafana.com/security/security-advisories/cve-2026-21725"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,12.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "analysis": {"en": {"generated_at": "2026-04-15T18:03:55.303104+00:00", "value": {"mitigation_remediation": ["Deploy the latest Grafana release that includes the vendor\u2019s security fix once it is publicly available.", "Configure datasource UIDs to be immutable and reject reuse of deleted identifiers; enable configuration that requires a unique UID for every datasource.\n", "Limit the ability to delete datasources to a dedicated system\u2011administration role and remove per\u2011datasource administrative rights unless absolutely necessary.\n", "Enable comprehensive audit logging for datasource create and delete actions and set alerts for rapid delete\u2011recreate activity on the same UID."], "summary": {"action": "Assess Impact", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "The flaw is reported against Grafana Enterprise installations; a specific version range is not listed, so any instance that employs the default datasource\u2011deletion logic may be vulnerable. Administrators should verify their Grafana edition and examine vendor advisories for any patch that addresses this TOCTOU bug.\n", "description_and_impact": "Grafana\u2019s datasource deletion process contains a time\u2011of\u2011create\u2011to\u2011time\u2011of\u2011use flaw that allows an attacker who once had administrative rights on a datasource to delete it again after that datasource is recreated with the same unique identifier. The flaw lies in the logic that does not invalidate a datum\u2019s authorization when the underlying resource is regenerated within a short window. As a result, an attacker can remove a datasource that no longer belongs to them, potentially disrupting monitoring services or corrupting configuration data. This weakness is identified as CWE\u2011367, a classic TOCTOU bug that directly undermines access control.\n\nThe vulnerability is only exploitable under a very narrow set of conditions: the attacker must retain dashboard\u2011level administrator rights on the original datasource; the deletion and immediate recreation must occur on the same Grafana pod; the recreated datasource must not grant the attacker new administrative privileges; the UID of the new datasource must match exactly that of the deleted one (raised by default but randomised by Grafana); and the entire sequence must be finished within thirty seconds. If any of these constraints are not satisfied, the flaw cannot be leveraged.\n\nBecause the conditions are stringent, the practical risk is relatively low. The CVSS base score is 2.6, the EPSS score is reported as less than 1\u202f%, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the impact if realized would be a full bypass of datasource\u2011level authorization, which could lead to a denial of service or loss of monitoring integrity.\n", "risk_and_exploitability": "The low CVSS score and EPSS value indicate a modest baseline severity, but the exploitability is limited by the time window, administrative privileges, and UID collision requirement. The attack vector likely involves an attacker who already controls a datasource as an administrator, and it may be confined to a single pod where the creation and deletion events occur in succession. The narrow attack surface reduces the likelihood of widespread exploitation.\n"}}}}, "created": "2026-02-26T13:18:07.748940+00:00", "updated": "2026-04-15T18:15:10.815495+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}