GHSA-WFHV-MJ62-F5XH Grafana: Users can generate Service Account tokens after permissions removal

🗓️ 13 May 2026 21:32:06Reported by GoogleType

osv

osv🔗 osv.dev👁 4 Views

Grafana: Removing token minting permissions may briefly allow token generation.

Reporter	Title	Published	Views	Family All 35
ATTACKERKB	CVE-2026-33381	13 May 202619:28	–	attackerkb
BDU FSTEC	The vulnerability of the Grafana monitoring and surveillance platform lies in the unauthorized access to the account after the token has expired, allowing attackers to gain unauthorized access to protected information.	19 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33381 vulnerabilities	30 May 202601:18	–	cgr
CNNVD	Grafana OSS 安全漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-33381	13 May 202619:28	–	cve
Cvelist	CVE-2026-33381 Users can generate Service Account tokens after permissions removal	13 May 202619:28	–	cvelist
EUVD	EUVD-2026-30146	13 May 202621:32	–	euvd
Github Security Blog	Grafana: Users can generate Service Account tokens after permissions removal	13 May 202621:32	–	github
Grafana	Users can generate Service Account tokens after permissions removal	13 May 202600:00	–	grafana
Tenable Nessus	Grafana Labs < 11.6.14+security-04 / 12.2.0 < 12.2.8+security-04 / 12.3.0 < 12.3.6+security-04 / 12.4.0 < 12.4.3+security-02 / 13.0.0 < 13.0.1+security-01 Multiple Vulnerabilities	22 May 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33381
github	www.github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86
github	www.github.com/grafana/grafana
grafana	www.grafana.com/security/security-advisories/cve-2026-33381

25 Jun 2026 23:11Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.9

EPSS0.00245

Grafana service account token minting permission removal temporary access