GHSA-wfhv-mj62-f5xh
Grafana: Users can generate Service Account tokens after permissions removal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/grafana/grafana | < 1.9.2-0.20260513165311-fb7336fc36c1 | 1.9.2-0.20260513165311-fb7336fc36c1 |
Details
As written in the advisory (Markdown source, shown as plain text).
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
References
External links from the advisory. They lead to third-party sites.