CVE-2026-21725

Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name

2.6 LowFix available

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.18%Up 0.2 points since Feb 26, 2026

What each source reports

CVE List Score used 2.6

Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Record: CVE-2026-21725
CVSS 3.1: 2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-367
Updated: 2026-11-02

EUVDEUVD-2026-8637 2.6

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Record: EUVD-2026-8637
CVSS 3.1: 2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w36g-f98m-wm99 2.6

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data...

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Record: GHSA-w36g-f98m-wm99
CVSS 3.1: 2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-367
Updated: 2026-11-02

NVD 2.6

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Record: CVE-2026-21725
CVSS 3.1: 2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1: 2.0 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-367
Updated: 2026-11-02

OSV 2.6

Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Record: CVE-2026-21725
CVSS 3.1: 2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-21725 2.6

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by default. - The datasource can now be re-deleted by the attacker. - Once 30 seconds are up, the attack is spent and cannot be repeated. - No datasource with any other UID can be attacked.

Record: UBUNTU-CVE-2026-21725
CVSS 3.1: 2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1: 2.0 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Show 8 moreShow less

OSVBIT-grafana-2026-21725 No score

Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.

This requires several very stringent conditions to be met:

The attacker must have admin access to the specific datasource prior to its first deletion.
Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.
The attacker must delete the datasource, then someone must recreate it.
The new datasource must not have the attacker as an admin.
The new datasource must have the same UID as the prior datasource. These are randomised by default.
The datasource can now be re-deleted by the attacker.
Once 30 seconds are up, the attack is spent and cannot be repeated.
No datasource with any other UID can be attacked.

Record: BIT-grafana-2026-21725
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10601-1 No score

grafana-11.6.14+security01-1.1 on GA media

These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10601-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20940-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)
Update to version 11.6.14+security-04: Security:
- CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
- CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
- CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
- CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
- CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
- CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
- CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
- CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
- CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
- CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)
CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)
CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)
Update to version 11.6.14+security-01: Security:
- CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
Update to version 11.6.14: Security:
- CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
- CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
- CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
- CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
- CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
- CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)
Update to version 11.6.13: Enhancement:
- Wire the public dashboard service to the HTTP server
Update to version 11.6.12: Enhancement:
- Update authentication redirect logic Bug fix:
- Fix single panel render with variable references

Record: openSUSE-SU-2026:20940-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21351-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

Add UI web assets as additional source tarball
Update to version 12.4.5 (jsc#PED-16512):
- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
Update to version 12.4.4:
- Security and quality updates.
- Various bug fixes and enhancements.
Update to version 12.4.3:
- Analytics: Keep internal dashboard id.
- Go: Update to 1.25.9.
- Reporting: Correctly apply appSubURL to report settings requests.
- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
Update to version 12.4.2:
- Various bug fixes and performance improvements.
- Dependency updates to core plugins and UI libraries.
Update to version 12.4.1:
- Bug fixes and minor quality-of-life enhancements.
- Updates to data source provisioning and dashboard schemas.
Update to version 12.4.0:
- Introduced dynamic dashboards in public preview.
- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
- Added the ability to create dashboards from templates using sample data.
- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
- Added support to map one variable to multiple values.
- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
Update to version 12.3.0:
- Released a completely redesigned logs visualization.
- Added the ability to export dashboards directly as PNG images.
- Introduced an interactive learning experience within the Grafana UI.
- Added a Switch template variable type to quickly toggle between values in queries.
- Added functionality to style table cells using CSS properties via the field cell option.
Update to version 12.2.0:
- Routine feature enhancements, minor bug fixes, and security patches.
Update to version 12.1.0:
- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
- Redesigned the alert rule list page.
- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
- Added support for Service Account Impersonation in the BigQuery data source.
- Introduced the Grafana Advisor in public preview.
Update to version 12.0.0:
- BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.
- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
- Introduced a new dashboard schema to replace the original single grid layout.
CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Record: openSUSE-SU-2026:21351-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1524-1 No score

Security update 5.1.3 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

Internal changes to fix build issues with no impact for customers

golang-github-prometheus-prometheus:

Security issues fixed:
- CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
  - Bumped rollup to version 4.59.0
- CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
  - Bumped brace-expansion to version 5.0.2
- CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
- CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
- CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
  - Bumped google.golang.org/grpc to version 1.79.3

grafana:

Security issues fixed:
- CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
- CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
- CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
- CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)
- CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)
- CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
- CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
- CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
- CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
- CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
- CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
- CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
- CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)
Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:
- Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability
- Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences
- Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced
- Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface
- One-Click Actions: Visualizations now support faster navigation via one-click links and actions
- Alerting History: Added version history for alert rules, allowing you to track changes over time
- Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
- Cron Support: Annotations now support Cron syntax for more flexible scheduling
- Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath
- Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting
- Alerting Limits: Added size limits for expanded notification templates to prevent system strain
- RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
- Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries
- Dashboard Reliability:
  - Fixed bugs involving row repeats and 'self-referencing' data links
  - Fixed a bug preventing single panels from…

Record: SUSE-SU-2026:1524-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2243-1 No score

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

Security Fixes:
- CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

Backward Compatibility and packaging changes:
- Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
- Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility
Version 1.10.2:
- Fixed typo in Zswap metric name (meminfo)
Version 1.10.1:
- Fixed mount points being collected multiple times (filesystem)
- Refactored mountinfo parsing (bsc#1261810)
- Added Zswap/Zswapped metrics (meminfo)
Version 1.10.0:
- New collectors: PCIe devices, swaps
- Added systemd virtualization metrics, AIX metrics
- WiFi packet metrics, additional PCIe and TLB metrics
- Changed mdadm to use sysfs, added erofs to excluded filesystems
- Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

Security issues fixed:
- CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
- CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
- CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
- CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
  - Bump google.golang.org/grpc to version 1.79.3
- CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
  - Bump rollup to version 4.59.0
Other changes:
- Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
- Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

Security Fixes:
- CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
- CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
- CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)
Highlights of other changes and bug fixes:
- Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

Security Fixes:
- CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
- CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
- CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
- CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
- CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
- CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
- CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
- CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
- CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
- CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
- CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)
Highlights of other changes and bug fixes:
- Version 11.6.13:
  - Wire the public dashboard service to the HTTP server
- Version 11.6.12:
  - Update authentication redirect logic
  - Fixed single panel render with variable references

spacecmd:

Version…

Record: SUSE-SU-2026:2243-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2258-1 No score

Security update for grafana

This update for grafana to version to 11.6.14+security01 fixes the following issues:

Security Fixes:
- CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
- CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
- CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
- CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
- CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
- CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
- CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
- CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
- CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
- CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
- CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)
Highlights of other changes and bug fixes:
- Version 11.6.13:
  - Wire the public dashboard service to the HTTP server
- Version 11.6.12:
  - Update authentication redirect logic
  - Fixed single panel render with variable references

Record: SUSE-SU-2026:2258-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3718-1 No score

Security update for grafana

This update for grafana fixes the following issues:

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

Add Legal-Review-Notice (bsc#1271327)
Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
Analytics: Keep internal dashboard id.
Reporting: Correctly apply appSubURL to report settings requests
Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
Dependency updates to core plugins and UI libraries.
Updates to data source provisioning and dashboard schemas.
Introduced dynamic dashboards in public preview.
Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
Added the ability to create dashboards from templates using sample data.
Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
Added support to map one variable to multiple values.
Released a completely redesigned logs visualization.
Added the ability to export dashboards directly as PNG images.
Introduced an interactive learning experience within the Grafana UI.
Added a Switch template variable type to quickly toggle between values in queries.
Added functionality to style table cells using CSS properties via the field cell option.
Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
Redesigned the alert rule list page.
Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
Added support for Service Account Impersonation in the BigQuery data source.
Introduced the Grafana Advisor in public preview.
Introduced a new dashboard schema to replace the original single grid layout.
MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

Record: SUSE-SU-2026:3718-1
Updated: 2026-11-02

Affected products

grafana

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Bitnami	11.0.0 up to 12.4.1	12.4.1
`golang-github-lusitaniae-apache_exporter` SUSE:Multi Linux Manager Tools SLE-15 From an advisory covering 17 CVEs	before 1.0.10-150002.3.6.1	1.0.10-150002.3.6.1
`golang-github-prometheus-prometheus` SUSE:Multi Linux Manager Tools SLE-15 From an advisory covering 17 CVEs	before 3.5.0-150002.3.8.1	3.5.0-150002.3.8.1
`grafana` SUSE:Multi Linux Manager Tools SLE-15 From an advisory covering 17 CVEs	before 11.6.14+security01-150002.4.14.1	11.6.14+security01-150002.4.14.1
`prometheus-blackbox_exporter` SUSE:Multi Linux Manager Tools SLE-15 From an advisory covering 17 CVEs	before 0.26.0-150002.3.6.1	0.26.0-150002.3.6.1
`spacecmd` SUSE:Multi Linux Manager Tools SLE-15 From an advisory covering 17 CVEs	before 5.1.13-150002.3.9.3	5.1.13-150002.3.9.3
`uyuni-tools` SUSE:Multi Linux Manager Tools SLE-15 From an advisory covering 17 CVEs	before 5.1.26-150002.3.12.1	5.1.26-150002.3.12.1
`prometheus-blackbox_exporter` SUSE:Multi Linux Manager Tools SLE-Micro-5 From an advisory covering 17 CVEs	before 0.26.0-150002.3.6.1	0.26.0-150002.3.6.1
`uyuni-tools` SUSE:Multi Linux Manager Tools SLE-Micro-5 From an advisory covering 17 CVEs	before 5.1.26-150002.3.12.1	5.1.26-150002.3.12.1
`grafana` SUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 22 CVEs	before 12.4.5-150200.3.91.1	12.4.5-150200.3.91.1

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`grafana` Ubuntu:16.04:LTS	All versions, plus listed versions 2.6.0+dfsg-1	None known
`grafana` openSUSE:Tumbleweed From an advisory covering 12 CVEs	before 11.6.14+security01-1.1	11.6.14+security01-1.1
`grafana` openSUSE:Leap 16.0 From an advisory covering 24 CVEs	before 11.6.14+security04-bp160.1.1	11.6.14+security04-bp160.1.1
`grafana` openSUSE:Leap 16.0 From an advisory covering 3 CVEs	before 12.4.5-bp160.1.1	12.4.5-bp160.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-21725 is a low vulnerability (CVSS 2.6) in Grafana, published February 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in grafana 12.4.1.

References

Show 108 moreShow less

This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.