CVE-2026-21725 Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name
An attacker with prior admin access can delete a recreated datasource without permission due to a race condition, requiring strict timing and UID reuse.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-21725?
CVE-2026-21725 is a low-severity vulnerability in Grafana Grafana, published on 25 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions to be met:
- The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by default. - The datasource can now be re-deleted by the attacker. - Once 30 seconds are up, the attack is spent and cannot be repeated. - No datasource with any other UID can be attacked.
Weakness: CWE-367
Which versions are affected by CVE-2026-21725?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 11.0.0 | 12.4.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-21725?
Upgrade grafana to 12.4.1 or later.
Is CVE-2026-21725 being exploited?
There is no known exploitation of CVE-2026-21725 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-21725, GHSA-w36g-f98m-wm99, MINI-26hr-w278-wh82, MINI-2m4r-wh6v-jrv9, MINI-2wp4-2fv9-5v2j, MINI-3gv6-8c75-j4r6 and 13 more.