REPRO-2026-00227: Grafana unified storage IAM service account listing lacked RBAC filtering, allowing low-privileged users to enumerate service accounts.
REPRO-2026-00227 is verified against grafana/grafana · Go affected versions: Versions prior to commit 8891796ca1086cd234e1715ea71d8db0073cc160 (fix adds RBAC allowlist for serviceaccounts) fixed version: Commit 8891796ca1086cd234e1715ea71d8db0073cc160 This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00227.
pruva-verify REPRO-2026-00227 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00227/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Grafana unified storage RBAC allowlist in pkg/storage/unified/resource/access.go did not include 'serviceaccounts' under the 'iam.grafana.app' API group. The authzLimitedClient bypassed RBAC filtering for list/search/read operations on service account resources, allowing low-privileged users to enumerate service accounts without proper permissions.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.