CVE-2026-15577 Overview
CVE-2026-15577 is an incorrect authorization vulnerability [CWE-863] in Grafana's Git Sync (provisioning) feature. A user or service account holding read-only access to Git Sync connections can modify a connection's configuration by writing to the status subresource. The flaw bypasses the intended role separation between read and write operations on provisioning connections. On Grafana 12.4, the affected API surface is exposed only when the experimental provisioning feature toggle is enabled. The issue affects integrity of provisioning configurations without directly exposing data or impacting availability.
Critical Impact
Read-only principals can tamper with Git Sync connection configuration, enabling unauthorized changes to provisioning sources that drive dashboards and infrastructure state.
Affected Products
- Grafana 12.4 with the experimental provisioning feature toggle enabled
- Grafana Git Sync (provisioning) connections API
- Deployments granting read-only access to provisioning resources
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-15577 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-15577
Vulnerability Analysis
The vulnerability resides in the authorization logic applied to the status subresource of Git Sync provisioning connections. Kubernetes-style resources typically expose a status subresource separately from the main spec, and each requires distinct authorization checks. Grafana's implementation applied insufficient authorization when a client wrote to the status subresource of a provisioning connection. An authenticated principal with read-only permissions on the connection resource can issue writes against the status endpoint and change configuration state.
The impact is limited to integrity: the attacker alters configuration but does not directly read sensitive data or crash the service. Because Git Sync drives dashboard and provisioning state from external Git repositories, tampering with a connection can redirect provisioning to attacker-influenced sources or disrupt synchronization behavior. The CWE-863 classification reflects authorization that executes but applies the wrong policy for the requested operation.
Root Cause
The root cause is missing or incorrect authorization enforcement on the status subresource of the Git Sync connection API. Authorization decisions evaluated the top-level resource verb set but did not require write permissions for status mutations, allowing read-only accounts to perform state-modifying operations.
Attack Vector
Exploitation requires network access to the Grafana API and valid credentials for a user or service account with read-only access to Git Sync connections. The attacker sends a crafted request to the status subresource of a target connection, modifying fields that influence connection configuration. No user interaction is required, and the attack complexity is low. Exploitation is only possible when the experimental provisioning feature toggle is enabled on Grafana 12.4.
See the Grafana Security Advisory CVE-2026-15577 for vendor technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-15577
Indicators of Compromise
- Unexpected HTTP PUT or PATCH requests to Git Sync connection /status subresource endpoints from accounts without write roles
- Modifications to Git Sync connection configuration not correlated with administrative activity
- Service accounts scoped to read-only roles issuing state-changing API calls to provisioning resources
Detection Strategies
- Enable and ship Grafana audit logs to a centralized analytics platform, filtering for write operations against provisioning status subresources
- Correlate the identity performing the API call with its assigned Grafana role to flag mismatches between permission and action
- Alert on configuration drift in Git Sync connections that was not initiated through change-management workflows
Monitoring Recommendations
- Monitor API request logs for the provisioning API group, specifically status subresource writes
- Track role-to-action mappings for all accounts with any level of access to provisioning resources
- Review the state of the experimental provisioning feature toggle across all Grafana instances and alert on unexpected enablement
How to Mitigate CVE-2026-15577
Immediate Actions Required
- Disable the experimental provisioning feature toggle on Grafana 12.4 instances where Git Sync is not required
- Audit all accounts holding read-only access to Git Sync connections and remove unnecessary access
- Review Git Sync connection configurations for unauthorized changes and restore known-good state from source control
- Apply the patched Grafana release referenced in the vendor advisory as soon as it is available in your deployment channel
Patch Information
Refer to the Grafana Security Advisory CVE-2026-15577 for the fixed version and upgrade guidance. The fix enforces proper authorization on the status subresource so that write operations require corresponding write permissions on the parent resource.
Workarounds
- Disable the experimental provisioning feature toggle until the patched release is deployed
- Restrict network access to the Grafana API to trusted administrative networks
- Rotate credentials for service accounts that previously held read-only access to provisioning resources after patching
# Example: disable the experimental provisioning feature toggle in grafana.ini
[feature_toggles]
provisioning = false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
