CVE-2026-21725: 
Grafana vulnerability analysis and mitigation

CVE-2026-21725 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in Grafana that allows a former datasource admin to perform unauthorized deletion of a recreated datasource. It affects Grafana Enterprise versions 11.0.0 through 12.4.0 (fixed in 12.4.1). The vulnerability was published on February 25, 2026, and assigned by Grafana Labs. It carries a CVSS v3.1 base score of 2.0 (Low) per NVD, or 2.6 (Low) per Grafana Labs' own assessment (Grafana Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-367 (Time-of-check Time-of-use Race Condition). When a datasource is deleted in Grafana, the system retains the former admin's authorization context for up to 30 seconds on the same pod. If another user recreates a datasource with the identical UID during this window, the former admin can exploit the stale authorization state to delete the newly created datasource without holding any permissions on it. Exploitation requires the attacker to have previously held admin access to the original datasource, the recreated datasource to share the same UID (randomized by default), and all steps to occur within a 30-second window on the same Grafana pod (Grafana Advisory, Red Hat Bugzilla).

Successful exploitation results in unauthorized deletion of a Grafana datasource, constituting a limited denial-of-service impact on data source connectivity. There is no confidentiality impact, as no data is exposed, and no broader integrity impact beyond the deletion of the specific datasource. The attack scope is tightly constrained — only one datasource with a specific UID can be targeted per 30-second window, and the attack cannot be repeated or extended to other datasources (Grafana Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.033%, reflecting the very low probability of exploitation given the stringent preconditions. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The combination of required prior admin access, a 30-second exploitation window, same-pod constraint, and the need for an identical (randomized) UID makes real-world exploitation highly unlikely (Grafana Advisory, Red Hat Bugzilla).

1. Obtain prior admin access: The attacker must first legitimately hold admin privileges on a specific Grafana datasource.
2. Delete the datasource: The attacker deletes the datasource, triggering the start of the 30-second authorization window on the current Grafana pod.
3. Wait for recreation: Within the 30-second window, a legitimate user must recreate the datasource — the attacker may need to socially engineer or anticipate this action.
4. Confirm UID match: The recreated datasource must have the same UID as the deleted one (this is randomized by default, making it unlikely unless UIDs are manually assigned or predictable).
5. Issue deletion request: The attacker sends a deletion API request for the datasource by UID before the 30-second window expires, exploiting the stale authorization state to delete the datasource without holding admin rights on the new instance.
6. Attack expires: After 30 seconds, the stale authorization context is cleared and the attack cannot be repeated for any other datasource or UID (Grafana Advisory).

• Logs: Grafana audit logs showing a datasource deletion event by a user who is not listed as an admin of the current datasource instance; two deletion events for the same datasource UID within a short time window (under 30 seconds).
• Network: API calls to the Grafana datasource deletion endpoint (e.g., DELETE /api/datasources/uid/<uid>) from a user account that lacks current admin permissions on that datasource.
• Behavioral: A datasource being deleted and recreated in rapid succession, particularly if the UID is reused and the recreating user differs from the deleting user.

Grafana has released version 12.4.1 which addresses this vulnerability; users running Grafana Enterprise v11.0.0 through v12.4.0 should upgrade to v12.4.1 or later. As interim mitigations, administrators should enforce strict access controls to limit who can obtain datasource admin privileges, monitor datasource creation and deletion events for anomalous patterns, and audit datasource UID assignment to ensure randomization is not overridden. In multi-pod deployments, reviewing cross-pod state synchronization and session routing can further reduce exposure (Grafana Advisory, SUSE Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2442609) and assessed it as low severity and low priority, with no immediate fix planned for downstream packages at time of disclosure. SUSE issued a security update announcement (SUSE-SU-2026:2258-1) addressing this and other Grafana issues. Coverage was limited to vulnerability database aggregators and national CERTs (INCIBE, CCN-CERT), reflecting the low practical risk of the vulnerability (Red Hat Bugzilla, SUSE Advisory).