---
id: CVE-2026-15577
title: >-
  A user or service account with read-only access to Git Sync (provisioning)
  connections can modify a connection's configuration through its status
  subresource (incorrect authorization)
summary: >-
  A user or service account with read-only access to Git Sync (provisioning)
  connections can modify a connection's configuration through its status
  subresource (incorrect authorization). On Grafana 12.4 the affected API is
  only available w…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-863
  - CWE-425
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - multicluster_global_hub
  - advanced_cluster_management_for_kubernetes 2
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
patched:
  - hardened_images
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:02:37.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15577'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-15577'
    label: security@grafana.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15577.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-15577'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550704'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-15577'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15577'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84422'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85544'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00269
epssPercentile: 0.19009
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T17:26:14.086881Z'
ingestedAt: '2026-10-13T18:41:42.741Z'
---

## Overview

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 10, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15577.json)
- **RHSA-2026:84422** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:84422)
- **RHSA-2026:85544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85544)