Executive Summary

CVE-2026-21725 is a low-severity authorization bypass vulnerability in Grafana related to datasource deletion.

It is a time-of-check-to-time-of-use (TOCTOU) flaw that allows an attacker to re-delete a recently deleted and then recreated datasource without proper permission.

• The attacker must have admin access to the datasource before its initial deletion.
• All attack steps must occur within 30 seconds and on the same Grafana pod.
• The attacker deletes the datasource, then another user recreates it.
• The recreated datasource must have the same UID as the original but not include the attacker as an admin (UIDs are randomized by default).
• Under these conditions, the attacker can delete the datasource again.

After 30 seconds, the vulnerability expires and cannot be exploited further. No datasources with different UIDs are vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with prior admin access to a datasource to delete that datasource again after it has been deleted and recreated by someone else, without having permission to do so.

The impact is limited to low availability since the attacker can cause the datasource to be deleted again, potentially disrupting access to that datasource temporarily.

The attack is complex to perform, requires specific timing (within 30 seconds), and user interaction, reducing the likelihood of exploitation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Grafana to version 12.4.1 or later where the issue has been fixed.

Additionally, be aware that the attack requires admin access to the datasource prior to deletion and must be executed within 30 seconds on the same Grafana pod, so monitoring and restricting admin privileges and pod access can help reduce risk.

Useful 0 Not Useful 0