Medium severity5.9NVD Advisory· Published May 13, 2026· Updated Jun 16, 2026

CVE-2026-33381

Description

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/grafana/grafanaGo	< 1.9.2-0.20260513165311-fb7336fc36c1	1.9.2-0.20260513165311-fb7336fc36c1

Affected products

Grafana/Grafana2 versions
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*range: >=11.6.0,<11.6.14
- (no CPE)
osv-coords6 versions
pkg:apk/chainguard/grafana-12.4 pkg:apk/chainguard/grafana-fips-12.4 pkg:apk/wolfi/grafana-12.4 pkg:bitnami/grafana pkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
< 12.4.3.02-r0+ 5 more
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: < 12.4.4-r0
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: >= 9.2.0, < 11.6.14
- (no CPE)range: < 11.6.14+security04-bp160.1.1
- (no CPE)range: < 11.6.14+security04-1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wfhv-mj62-f5xhghsaADVISORY
grafana.com/security/security-advisories/cve-2026-33381nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-33381ghsaADVISORY
github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000