CVE-2026-15577
MEDIUM 6.5A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 19th percentile
Impact if exploited
6.5CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-863: Incorrect authorization
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References and research data (JSON)
Vendor product assessments
Showing 32 of 37 vendor product statements; 5 omitted. Read the full vendor advisory.
grafana12.4-0:12.4.12-0.5.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana12.4-0:12.4.12-0.5.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana12.4-0:12.4.12-0.5.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
multicluster-globalhub/multicluster-globalhub-grafana-rhel9 as a component of Multicluster Global Hub · known affected
Vendor assessment for this product only.
pkg:oci/multicluster-globalhub-grafana-rhel9@sha256:7092341d99cdb2da484f2770c94c48f0fc38e1c3f59c854ad7bdea0e6db8aa73?repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
- none available: Fix deferred
rhacm2/acm-grafana-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known affected
Vendor assessment for this product only.
pkg:oci/acm-grafana-rhel9@sha256:aa7ca316ec068e466c4a413b83b3f24a26653dc2c63497a5f6f48a8cc44c36c7?repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9
- none available: Fix deferred
rhceph/grafana-rhel9 as a component of Red Hat Ceph Storage 7 · known affected
Vendor assessment for this product only.
pkg:oci/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c?repository_url=registry.redhat.io/rhceph/grafana-rhel9
- none available: Fix deferred
rhceph/grafana-rhel10 as a component of Red Hat Ceph Storage 9 · known affected
Vendor assessment for this product only.
pkg:oci/grafana-rhel10@sha256:04469a55551c52b0c535bee8734003b4ada037bf47ec298c521e12379cdcae69?repository_url=registry.redhat.io/rhceph/grafana-rhel10
- no fix planned: Out of support scope
grafana as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana
- none available: Fix deferred
grafana-azure-monitor as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-azure-monitor
- none available: Fix deferred
grafana-cloudwatch as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-cloudwatch
- none available: Fix deferred
grafana-elasticsearch as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-elasticsearch
- none available: Fix deferred
grafana-graphite as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-graphite
- none available: Fix deferred
grafana-loki as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-loki
- none available: Fix deferred
grafana-mssql as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-mssql
- none available: Fix deferred
grafana-mysql as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-mysql
- none available: Fix deferred
grafana-postgres as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-postgres
- none available: Fix deferred
grafana-prometheus as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-prometheus
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana-stackdriver as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-stackdriver
- none available: Fix deferred
grafana.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana?arch=src
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- no fix planned: Out of support scope
grafana.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana?arch=src
- no fix planned: Out of support scope
All CVSS metrics
- MEDIUM 6.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
Advisories
- https://grafana.com/security/security-advisories/cve-2026-15577 CVE record · GRAFANA · Updated 2026-10-13T17:05:49.743Z
NVD · CVE-2026-15577 · Updated 2026-10-16T20:02:37.630
Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15577.json Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98904 EUVD · EUVD-2026-98904
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-15577 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2550704 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-15577 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-15577 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://access.redhat.com/errata/RHSA-2026:84422 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://access.redhat.com/errata/RHSA-2026:87077 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00
- https://access.redhat.com/errata/RHSA-2026:85544 Red Hat · CVE-2026-15577 · Updated 2026-10-21T19:42:10+00:00