Executive brief
A security flaw in Grafana could allow a user who previously had administrative access to a data source to delete it again even after it has been recreated by someone else. This requires a very specific set of circumstances, including the attacker acting within 30 seconds of the data source being recreated with the exact same identifier. While the impact is limited to the deletion of the data source, it could cause temporary disruption to dashboards and monitoring services.
Technical details
A time-of-check-to-time-of-use (TOCTOU) vulnerability (CWE-367) exists in Grafana's data source management. If an attacker with prior admin access deletes a data source and it is subsequently recreated with the same Unique Identifier (UID) within a 30-second window on the same pod, the attacker can delete the new instance despite no longer having administrative privileges. The attack is highly constrained as it requires the new data source to reuse a specific UID (which are randomized by default) and relies on a narrow timing window. The vulnerability is fixed in Grafana version 12.4.1.
Affected products
- Grafana Labs Grafana 11.0.0 to 12.4.1
- Grafana Labs Grafana Enterprise 11.0.0 to 12.4.1
Timeline
- 2026-02-25: disclosed
- 2026-02-25: advisory
- 2026-02-25: patched: Fixed in version 12.4.1