{"id":"CVE-2026-21725","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-21725","generatedAt":"2026-10-28T00:19:05.996Z","title":"A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.","description":"A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.\n\nThis requires several very stringent conditions to be met:\n\n- The attacker must have admin access to the specific datasource prior to its first deletion.\n- Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.\n- The attacker must delete the datasource, then someone must recreate it.\n- The new datasource must not have the attacker as an admin.\n- The new datasource must have the same UID as the prior datasource. These are randomised by default.\n- The datasource can now be re-deleted by the attacker.\n- Once 30 seconds are up, the attack is spent and cannot be repeated.\n- No datasource with any other UID can be attacked.","published":"2026-02-25T13:16:05.000Z","lastModified":"2026-06-17T13:20:06.000Z","status":"Modified","sourceIdentifier":"security@grafana.com","cvss":{"version":"3.1","score":2,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N"},"cwe":["CWE-367"],"affected":["grafana/grafana"],"epss":{"score":0.00184,"percentile":0.07951,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-21725","tags":["Vendor Advisory"],"source":"security@grafana.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-21725","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}