PT-2026-21901 · Grafana · Grafana

Se1En · Published 2026-02-25 · Updated 2026-05-10 · CVE-2026-21725

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description A time-of-create-to-time-of-use (TOCTOU) issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to the data source before initial deletion, all steps completed within 30 seconds on the same Grafana pod, recreation of the data source by another user, the new data source having the same UID as the previous one, and the attacker not being an admin of the new data source.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BIT-GRAFANA-2026-21725

CVE-2026-21725

OPENSUSE-SU-2026:10601-1

SUSE-SU-2026:1524-1

Affected Products

Grafana

References · 61

• https://cve.org/CVERecord?id=CVE-2026-21725 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1524-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21725 · Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2026-21725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21725 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10601-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2026-21725 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21725 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21725 · Vendor Advisory
• https://bugzilla.suse.com/1261027 · Note
• https://suse.com/security/cve/CVE-2026-21720 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261524-1 · Note
• https://suse.com/security/cve/CVE-2026-1615 · Note
• https://bugzilla.suse.com/1258873 · Note
• https://suse.com/security/cve/CVE-2026-27606 · Note