medium5.9
CVE-2026-33381
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event.
Impact
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | < 1.9.2-0.20260513165311-fb7336fc36c1 | 1.9.2-0.20260513165311-fb7336fc36c1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | from 11.6.0 before 11.6.14 from 12.2.0 before 12.2.8 from 12.3.0 before 12.3.6 from 12.4.0 before 12.4.3 from 13.0.0 before 13.0.1 |