CVE-2026-21725: Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name
A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions to be met:
- The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by default. - The datasource can now be re-deleted by the attacker. - Once 30 seconds are up, the attack is spent and cannot be repeated. - No datasource with any other UID can be attacked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure datasource UIDs remain randomized and do not reuse previous UIDs. Do not create a new datasource with the same UID as a recently deleted datasource.
Grafana datasources uid_randomization = enabled - Compensating control
Restrict datasource administrator privileges to a minimal set of trusted accounts and audit/administer role assignments. Limit who can delete datasources to reduce risk that an attacker has admin access to a datasource prior to its deletion.
- Compensating control
Prevent or discourage immediate recreate-on-same-pod workflows: require a wait period longer than 30 seconds before recreating a deleted datasource or ensure recreated datasources land on a different Grafana pod. This reduces the window and pod-local conditions required for the TOCTOU exploit.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21725?
CVE-2026-21725 is classified as a high-severity vulnerability due to its potential for authorization bypass.
How do I fix CVE-2026-21725?
To fix CVE-2026-21725, ensure you upgrade to the latest version of Grafana that contains the security patch.
What are the conditions required for CVE-2026-21725 to be exploited?
CVE-2026-21725 can be exploited when an attacker deletes and then recreates a data source before it is properly cleared from access controls.
What impact does CVE-2026-21725 have on Grafana?
CVE-2026-21725 allows an unauthorized user to delete data sources in Grafana that they should not have permission to modify.
Is CVE-2026-21725 specific to certain versions of Grafana?
Yes, CVE-2026-21725 affects specific versions of Grafana, and users should refer to the vendor's advisory for details on affected versions.