CVE-2026-21725

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description A time-of-create-to-time-of-use (TOCTOU) issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to the data source before initial deletion, all steps completed within 30 seconds on the same Grafana pod, recreation of the data source by another user, the new data source having the same UID as the previous one, and the attacker not being an admin of the new data source.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.