Executive brief
Grafana is an open-source platform for monitoring and observability. A security flaw was identified where users whose permissions to create service account tokens have been revoked can still generate new tokens for a short window of time. This could allow a recently restricted user to maintain unauthorized access to the system by creating long-lived credentials before the revocation fully takes effect.
Technical details
A race condition or caching delay in Grafana's Role-Based Access Control (RBAC) system allows for improper access control (CWE-284). When a user's permission to 'mint' or generate tokens for a service account is revoked, the change is not immediately enforced across all sessions or nodes, leaving a window of several seconds where token generation is still possible. An attacker with high privileges (the initial permission to create tokens) can exploit this by automating token creation immediately after their access is revoked. This allows them to maintain persistent access via a new service account token despite the administrative action to restrict them. The fix involves improving RBAC cache invalidation on permission changes.
Affected products
- Grafana Grafana OSS 9.2.0 <= 11.6.14; 12.0.0 <= 12.2.8; 12.3.0 <= 12.3.6; 12.4.0 <= 12.4.3; 13.0.0 <= 13.0.1
Timeline
- 2026-05-13: disclosed
- 2026-05-13: patched
- 2026-05-13: advisory