CVE-2026-15577: Grafana Git Sync authorization bypass in status subresource
CVE-2026-15577 · Severity: medium · CVSS 6.5 · Published 2026-10-13
Grafana is an open-source data visualization and monitoring platform used by organizations to display metrics and create dashboards. A flaw in authorization allows users with read-only access to Git Sync provisioning connections to modify connection configurations, potentially allowing them to alter infrastructure deployments or expose sensitive connection credentials. This affects Grafana versions 12.4 through 13.2 when the provisioning feature is enabled.</brief>
<parameter name="technical_details">The vulnerability is an incorrect authorization check on the Git Sync connection status subresource API endpoint. A user with read-only (GET) permissions on provisioning connections can make modifications (PATCH/PUT) through the status subresource by exploiting insufficient access controls. This requires network access and an authenticated account with at minimum read-only permissions to the Git Sync connections.
No. Junglewise Threat Intelligence has no report of CVE-2026-15577 being exploited in the wild.
How severe is CVE-2026-15577?
Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?
Grafana Labs Grafana 12.4.0 to 12.4.12, 13.0.0 to 13.0.10, 13.1.0 to 13.1.7, 13.2.0 to 13.2.3.
Is there a fix for CVE-2026-15577?
Yes: fixed in Grafana 12.4.13, 13.0.11, 13.1.8, 13.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15577 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-15577?
Check whether you run Grafana Labs Grafana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.