Grafana’s datasource deletion process contains a time‑of‑create‑to‑time‑of‑use flaw that allows an attacker who once had administrative rights on a datasource to delete it again after that datasource is recreated with the same unique identifier. The flaw lies in the logic that does not invalidate a datum’s authorization when the underlying resource is regenerated within a short window. As a result, an attacker can remove a datasource that no longer belongs to them, potentially disrupting monitoring services or corrupting configuration data. This weakness is identified as CWE‑367, a classic TOCTOU bug that directly undermines access control. The vulnerability is only exploitable under a very narrow set of conditions: the attacker must retain dashboard‑level administrator rights on the original datasource; the deletion and immediate recreation must occur on the same Grafana pod; the recreated datasource must not grant the attacker new administrative privileges; the UID of the new datasource must match exactly that of the deleted one (raised by default but randomised by Grafana); and the entire sequence must be finished within thirty seconds. If any of these constraints are not satisfied, the flaw cannot be leveraged. Because the conditions are stringent, the practical risk is relatively low. The CVSS base score is 2.6, the EPSS score is reported as less than 1 %, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the impact if realized would be a full bypass of datasource‑level authorization, which could lead to a denial of service or loss of monitoring integrity.

The flaw is reported against Grafana Enterprise installations; a specific version range is not listed, so any instance that employs the default datasource‑deletion logic may be vulnerable. Administrators should verify their Grafana edition and examine vendor advisories for any patch that addresses this TOCTOU bug.

The low CVSS score and EPSS value indicate a modest baseline severity, but the exploitability is limited by the time window, administrative privileges, and UID collision requirement. The attack vector likely involves an attacker who already controls a datasource as an administrator, and it may be confined to a single pod where the creation and deletion events occur in succession. The narrow attack surface reduces the likelihood of widespread exploitation.