Users can generate Service Account tokens after permissions removal

🗓️ 13 May 2026 00:00:00Reported by Grafana LabsType

Users can generate Service Account tokens in a few seconds after permission removal; vulnerability reported via bug bounty program.

Reporter	Title	Published	Views	Family All 35
ATTACKERKB	CVE-2026-33381	13 May 202619:28	–	attackerkb
BDU FSTEC	The vulnerability of the Grafana monitoring and surveillance platform lies in the unauthorized access to the account after the token has expired, allowing attackers to gain unauthorized access to protected information.	19 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33381 vulnerabilities	30 May 202601:18	–	cgr
CNNVD	Grafana OSS 安全漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-33381	13 May 202619:28	–	cve
Cvelist	CVE-2026-33381 Users can generate Service Account tokens after permissions removal	13 May 202619:28	–	cvelist
EUVD	EUVD-2026-30146	13 May 202621:32	–	euvd
Github Security Blog	Grafana: Users can generate Service Account tokens after permissions removal	13 May 202621:32	–	github
Tenable Nessus	Grafana Labs < 11.6.14+security-04 / 12.2.0 < 12.2.8+security-04 / 12.3.0 < 12.3.6+security-04 / 12.4.0 < 12.4.3+security-02 / 13.0.0 < 13.0.1+security-01 Multiple Vulnerabilities	22 May 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)	14 Jun 202600:00	–	nessus