{"id":"CVE-2026-15577","title":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization)","summary":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available w…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-863","CWE-425"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["multicluster_global_hub","advanced_cluster_management_for_kubernetes 2","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","hardened_images"],"patched":["hardened_images"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:02:37.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15577","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-15577","label":"security@grafana.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15577.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15577"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550704"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15577"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15577"},{"url":"https://access.redhat.com/errata/RHSA-2026:84422"},{"url":"https://access.redhat.com/errata/RHSA-2026:85544"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00269,"epssPercentile":0.19009,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T17:26:14.086881Z"},"ingestedAt":"2026-10-13T18:41:42.741Z","slug":"CVE-2026-15577","body":"## Overview\n\nA user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15577.json)\n- **RHSA-2026:84422** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:84422)\n- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}