{"id":"EUVD-2026-30146","revision":"b15fd33542444ff5b7018513330fb6cf","records":[{"revision":"b15fd33542444ff5b7018513330fb6cf","observedAt":"2026-10-28T03:59:24.389+00:00","statement":{"source":"euvd","id":"EUVD-2026-30146","aliases":["CVE-2026-33381"],"title":"When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.","description":"When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9,"severity":null}],"references":["https://grafana.com/security/security-advisories/cve-2026-33381"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30146","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2026, 7:28:31 PM","dateUpdated":"Aug 27, 2026, 5:22:46 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-1546","title":"Grafana: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-33376"]},{"id":"SUSE-SU-2026:2768-1","title":"Security update 5.1.4 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2022-21698","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-34986","CVE-2026-39821","CVE-2026-40179","CVE-2026-41602","CVE-2026-42151","CVE-2026-42154","CVE-2026-42502","CVE-2026-42506"]},{"id":"SUSE-SU-2026:2774-1","title":"Security update 5.1.4 for Multi-Linux Manager Server","vulnerabilityIds":["CVE-2022-21698","CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-34986","CVE-2026-39821","CVE-2026-40179","CVE-2026-41602","CVE-2026-42151","CVE-2026-42154","CVE-2026-42198"]},{"id":"RHSA-2026:68767","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381"]},{"id":"RHSA-2026:68821","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-61709","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]},{"id":"SUSE-SU-2026:3718-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2025-12141","CVE-2025-30153","CVE-2026-21725","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-33382","CVE-2026-39821","CVE-2026-39882","CVE-2026-41607","CVE-2026-42502","CVE-2026-42506"]},{"id":"RHSA-2026:68778","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-42127","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30146","identifiers":["EUVD-2026-30146","CVE-2026-33381"]},"retained":false,"historicalAffected":[]}],"coverage":[]}