CVE-2026-33381: Grafana: Users can generate Service Account tokens after permissions removal

May 13, 2026 (updated June 18, 2026)

When a user’s access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

References

github.com/advisories/GHSA-wfhv-mj62-f5xh
github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86
grafana.com/security/security-advisories/cve-2026-33381
nvd.nist.gov/vuln/detail/CVE-2026-33381

Code Behaviors & Features

Detect and mitigate CVE-2026-33381 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →