REPRO-2026-00226: Grafana IAM LIST authorization could be bypassed for folder-scoped CRDs when a user had wildcard resource permissions, returning `All: true` without folder-level checks.
REPRO-2026-00226 is verified against grafana/grafana · Go affected versions: Versions prior to commit b9b897b3c512ee434341bb9d698eac24f90eca89 (folder-scoped LIST authz check occurs after wildcard scope check) fixed version: b9b897b3c512ee434341bb9d698eac24f90eca89 This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00226.
pruva-verify REPRO-2026-00226 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00226/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Grafana's listPermission for mapper-miss resources (folder-scoped CRDs like .ext.grafana.app) checked scopeMap[""] and returned All: true before invoking folder-scoped authorization. A user with a resource-type wildcard permission (e.g., widget.ext.grafana.app/widgets:get with scope *) could list all objects across folders without folder-level authorization.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.