[ CVE-2026-15577 · Published 13 Oct 2026 ]

Vulnerability in Grafana Enterprise

CVSS 6.5 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund13 Oct 2026WID-SEC-2026-3910

Grafana: Multiple vulnerabilities Translated from German
CVE-2026-33374CVE-2026-95502CVE-2026-93294+1 more CVEs

[ References ]References

grafana.com/security/security-advisories/cve-2026-15577

[ Facts ]Key facts

CVE: CVE-2026-15577
EUVD: EUVD-2026-98904
Published: 13 Oct 2026, 18:17 UTC
Updated: 16 Oct 2026, 20:02 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Scored by security@grafana.com
EPSS: 0.27% chance of exploitation in 30 days · higher than 18% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-863

[ Affected ]Affected products

Grafana Grafana Enterprise12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4
Grafana Grafana OSS12.4.0 – < 12.4.13, 13.0.0 – < 13.0.11, 13.1.0 – < 13.1.8, 13.2.0 – < 13.2.4

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Grafana: Multiple vulnerabilities Translated from German

[ References ]References