CVE-2026-15577— Git Sync connection configuration can be modified with read-only access
Quick assessment
Affected
Grafana Grafana Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
对 Git Sync（配置同步）连接具有只读权限的用户或服务账户，可以通过连接的 status 子资源（status subresource）修改该连接的配置（存在授权错误问题）。在 Grafana 12.4 中，仅当启用“实验性配置同步功能开关”（experimental provisioning feature toggle）时，该受影响的 API 才可用。
Possible ATT&CK Techniques 1 AI
T1136 · Create AccountAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grafana | Grafana Enterprise | 12.4.0< 12.4.13 |
affected |
13.0.0< 13.0.11 |
affected | ||
13.1.0< 13.1.8 |
affected | ||
13.2.0< 13.2.4 |
affected | ||
| Grafana | Grafana OSS | 12.4.0< 12.4.13 |
affected |
13.0.0< 13.0.11 |
affected | ||
13.1.0< 13.1.8 |
affected | ||
13.2.0< 13.2.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15577
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Git Sync connection configuration can be modified with read-only access
Source: CVE Program / CVE List V5
Vulnerability Description
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana Enterprise | 12.4.0 ~ 12.4.13 | - |
|
| Grafana | Grafana OSS | 12.4.0 ~ 12.4.13 | - |
|
II. Public POCs for CVE-2026-15577
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15577
请登录查看更多情报信息。
Other References for CVE-2026-15577 (1)
-
https://grafana.com/security/security-advisories/cve-2026-15577 vendor-advisory
Same Patch Batch · Grafana · 2026-10-13 · 4 CVEs total
| CVE-2026-33374 | 6.5 MEDIUM | Unbounded memory allocation in the Prometheus rule conversion API |
| CVE-2026-93294 | 6.3 MEDIUM | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager |
| CVE-2026-95502 | 5.3 MEDIUM | Git Sync memory exhaustion via a malicious Git server |
IV. Related Vulnerabilities
Same product: Grafana Enterprise
-
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb -
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-13719
Alert rules in restricted folders disclosed via the alert ru -
CVE-2026-81842
Library panel can be moved into a folder without library pan -
CVE-2026-81841
Paused shared dashboard access tokens still expose data sour
Same vendor: Grafana
-
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-95502
Git Sync memory exhaustion via a malicious Git server -
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb -
CVE-2026-89039
Arbitrary file read via the convert_playwright_script prompt -
CVE-2026-13720
Editor can forge file-provisioning provenance on dashboards
V. Comments for CVE-2026-15577
No comments yet