CVE-2026-21725
TOCTOU Vulnerability in Grafana Datasource Allows Unauthorized Deletion
Publication date: 2026-02-25
Last updated on: 2026-02-27
Assigner: Grafana Labs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grafana | grafana | From 11.0.0 (inc) to 12.4.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-21725 is a low-severity authorization bypass vulnerability in Grafana related to datasource deletion.
It is a time-of-check-to-time-of-use (TOCTOU) flaw that allows an attacker to re-delete a recently deleted and then recreated datasource without proper permission.
- The attacker must have admin access to the datasource before its initial deletion.
- All attack steps must occur within 30 seconds and on the same Grafana pod.
- The attacker deletes the datasource, then another user recreates it.
- The recreated datasource must have the same UID as the original but not include the attacker as an admin (UIDs are randomized by default).
- Under these conditions, the attacker can delete the datasource again.
After 30 seconds, the vulnerability expires and cannot be exploited further. No datasources with different UIDs are vulnerable.
How can this vulnerability impact me? :
This vulnerability allows an attacker with prior admin access to a datasource to delete that datasource again after it has been deleted and recreated by someone else, without having permission to do so.
The impact is limited to low availability since the attacker can cause the datasource to be deleted again, potentially disrupting access to that datasource temporarily.
The attack is complex to perform, requires specific timing (within 30 seconds), and user interaction, reducing the likelihood of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Grafana to version 12.4.1 or later where the issue has been fixed.
Additionally, be aware that the attack requires admin access to the datasource prior to deletion and must be executed within 30 seconds on the same Grafana pod, so monitoring and restricting admin privileges and pod access can help reduce risk.